Are google chrome extension "content" scripts sandboxed?

Question

I was under the impression that the content_scripts were executed right on the page, but it now seems as though there's some sandboxing going on.

I'm working on an extension to log all XHR traffic of a site (for debugging and other development purposes), and in the console, the following sniff code works:

 var o = window.XMLHttpRequest.prototype.open;
 window.XMLHttpRequest.prototype.open = function(){
     console.log(arguments, 'open');
     return o.apply(this, arguments);
 };
 console.log('myopen');
 console.log(window, window.XMLHttpRequest, window.XMLHttpRequest.prototype, o, window.XMLHttpRequest.prototype.open);

This logs a message everytime an XHR is sent. When I put this in an extension, however, the real prototype doesn't get modified. Apparently the window.XMLHttpRequest.prototype that my script is seeing differs from that of the actual page.

Is there some way around this? Also, is this sandboxing behavior documented anywhere? I looked around, but couldn't find anything.

Answer 1

You cannot do that. According to the documentation:

However, content scripts have some limitations. They cannot:

• Use chrome.* APIs (except for parts of chrome.extension)
• Use variables or functions defined by their extension's pages
• Use variables or functions defined by web pages or by other content scripts
• Make cross-site XMLHttpRequests