Update Browser_Extension_Vulnerabilities_Cheat_Sheet.md

[KadirArslan]

I've added chrome.runtime.sendMessage/onMessage check as a additional section.
This was missing on the CS

🚩 If your PR is related to grammar/typo mistakes, please double-check the file for other mistakes in order to fix all the issues in the current cheat sheet.

Please make sure that for your contribution:

• In case of a new Cheat Sheet, you have used the Cheat Sheet template.
• All the markdown files do not raise any validation policy violation, see the policy.
• All the markdown files follow these format rules.
• All your assets are stored in the assets folder.
• All the images used are in the PNG format.
• Any references to websites have been formatted as [TEXT](URL)
• You verified/tested the effectiveness of your contribution (e.g., the defensive code proposed is really an effective remediation? Please verify it works!).
• The CI build of your PR pass, see the build status here.

If your PR is related to an issue, please finish your PR text with the following line:

This PR fixes issue #<REPLACE WITH ISSUE NUMBER>.

AI Tool Usage Disclosure (required for all PRs)

Please select one of the following options:

• I have NOT used any AI tool to generate the contents of this PR.
• I have used AI tools to generate the contents of this PR. I have verified
  the contents and I affirm the results. The LLM used is [llm name and version]
  and the prompt used is [your prompt here]. [Feel free to add more details if needed]

Thank you again for your contribution 😃

[szh]

I'm not familiar with this API but I did some quick searching and I found that Google has additional guidelines on this: https://developer.chrome.com/docs/extensions/develop/concepts/messaging#content-scripts-are-less-trustworthy
Perhaps we should include their recommendations and link to this document?

[KadirArslan]

Thank you for the pointing this out. I've changed the mitigation section, changed to be more action item(ish) list that contains all of the info shared in chrome document.
Apart from that added secure example too.

@szh could you please review again?

[szh]

Once we're checking if it comes from an extension, why not also check the extension ID, like if (!sender.url?.startsWith('chrome-extension://<my-extension-id>'))

[KadirArslan]

sender.id already uniquely identifies the extension; checking the ID again in the URL would be redundant. URL validation can still be used optionally to restrict specific extension contexts.

[szh]

Should this id be the extension's id?

[KadirArslan]

Yes. sender.id is the ID of the extension that sent the message.
Comparing it to chrome.runtime.id ensures the message originated from this same extension.

[szh]

Thanks for the explanations. LGTM