[bzbarsky]

Yes, but in a browser extension context the web page controls the HTML involved and is the thing you want to defend against. So relying on the HTML to play nice is not OK.

[Disclaimer: I work for Mozilla.]