Attached is a simple content script that injects into all pages. It adds a <button> and <input> to the top of every webpage; when the button is clicked, it will do an authenticated fetch of the URL in the <input>.

Effectively, under the rules of the current extension system, a single installed content script with:

  "matches": ["*://*/*"],

will require granting every child process the ability to see the responses for arbitrary http/https resources. That effectively defeats site isolation.

Implementing general site isolation will require us to solve this challenge, and scale back privileges from existing content scripts work.

 

Deleted: content_script_scraper_problem.zip 1001 bytes

content_script_scraper_problem.zip 1001 bytes Download