v2.15.5

Security fix

Restricted cross-origin access to the local HTTP API by validating Host and Origin, replacing wildcard CORS with same-origin access and exact configured origin allowlists, and requiring Content-Type: application/json for JSON endpoints.

Reporter credit

Thanks to @orshih6 for responsibly reporting this issue and helping improve the security of the extension.

Full Changelog: v2.15.4...v2.15.5