[lxgr]

The latter poses some security problems, though, which the native messaging API avoids (e.g. random websites being able to connect to the native application and pretending to be your extension).

[vbezhenar]

When random websites connect to your application, you can (and should) inspect Referer header and filter out unwanted ones.