That sounds dangerous. I’ll keep my distance lest that pile topples.

Brah, other OS’s are full of holes too.

It is not necessary for the attack and was used to illustrate the vulnerable app manifest configuration.

They don't edit the manifest at all?

Eh, I kinda see that point. I never considered it a boundary anyway since it didn’t require any additional authentication or authorization. It always felt more like a “here be dragons” warning for people who may not know what their doing, but if you think about it your user context never changes.

Then you never thought about it - at least not in relation to who was responsible for it. I mean... because who would think that but Microsoft?