Yes, you're right. Now, it's difficult to controll the restriction for JavaScript in local files, using only web extension APIs. I'll implement it if I find a way, thanks.