Are you thinking of NoScript? That's what gives me the XSS popups.

uBlock prevents XSS? I didn't know that.

It doesn't matter if they are directly stealing cookies though.

This seems like a really basic vulnerability that whoever wrote the code to do that probably should have been aware of. It concerns be about the security of the rest of Lemmy if they're making such basic errors.