`socket` command allows sending data over WebSockets to arbitrary origins from Grammarly Extension

1. Attacker could trigger Grammarly extension's `socket` command using a crafted page to perform WS connection(and data sending) from extension's background page (with cookies and origin) to any URL. 2. Additionally, commands received from the attacker's server are handled by extension and could be …

function Z(e) {
           var t, n = e.action;
           ...
            "socket" === n && p.emitBackground(b.MessageTypes.client, e),
           ...
        }