I’m sure its common knowledge by now that whatever you write in text boxes on customer support chats can be seen by whoever is on the other side, without or before hitting send. Don’t you think that’s a breach of privacy?! I imagine it isn’t too difficult to implement a fix for it: The browser (like Firefox) could choose not to upload the user input to wherever the website links to, without user input (like click a send button).
The Firefox extension API explicitly requires user actions before an extension can do things like open popup windows.
Popups are a specific part of html that can have permissions built around it.
Text entered into a field is kind of broad. I’m not sure how to wrap that in a permission when the website can build that input however they want. There might be something to stop like live streaming or whatever telemetry is being called to capture the text, but that might break functionally.