Comment 6 for bug 1800715

If I understand correctly, the attack would have to be on a logged in session. So the attacker would have local access to the machine and the session already.
It is something for careful consideration though. I will loop in the security team for their thoughts.