Is it possible to access global JavaScript variables inside user scripts?

[brckd]

I am making a user script that is supposed to alter a website by overriding some variables and functions. It works on desktop, but does not seem to work on Cromite. I have inspected the window keys and they only contain the usual attributes, even though the targeted websites defines multiple vars and functions and the document state is interactive. Modifying the DOM works however. I found #589, which could be related, but doesn't explicitly say so.

[brckd]

I would also be interested if other aspects are also sandboxed like this. For example, is it possible to define service workers?

[uazo]

in cromite the choice was to separate the injected script from the website environment, technically the script runs in what is called an isolated world, different from the main world of the page.
this is because it allows a different csp to be defined, which for userscripts is script-src 'self'; object-src 'self';
the effect is therefore that no changes can be made outside userscript world.

For example, is it possible to define service workers?

not unless the sw script is static and embedded in a blob.

[brckd]

Oh, what a bummer, but thanks for clarifying. According to so, scripts can be injected into the html itself on runtime, so there might be a way to circumwent this. 🤔

var tag = document.createElement("script");
tag.src = "http://jact.atdmt.com/jaction/JavaScriptTest";
document.getElementsByTagName("head")[0].appendChild(tag);

I'm glad service workers are possible! I am using a bundler anyways, so it shouldn't be a problem to embed them like that.

[uazo]

so there might be a way to circumwent this.

no, it should not work. why, does it work?

[uazo]

@brckd Sorry to bother you, could you answer me? If what you write is true, it would be a big bug.

[brckd]

I haven't tested it yet, but I'll do now and raise an issue if it's actually the case.