Console demo allows XMLHttpRequests to CORS-enabled servers about jailed

[asvd]

"Monkey-patching" is not about security, I added it to prevent confusing a user of the console: the worker scope is not actually related to the purposes of the demo. See: #1

Jailed reuses a sandboxed iframe and relies on it in questions of security, just providing more convenient API for invocation of a code of an opposite site (comparing to sending and handling messages):

https://github.com/asvd/jailed#in-a-web-browser

Therefore the opportunity to create a botnet in the way you described is not prevented by the browser, and is probably a subject to be reported to the browsers' developers.

Please let me know if you think that the issue should be handled by the Jailed somehow (I can hardly imagine if this can be done without the browser feature).