Content scripts run in isolated worlds

CWE-79 (XSS) and CWE-653 (Insufficient Compartmentalization) both apply when content scripts run in the MAIN world. A content script in the MAIN world shares the JavaScript heap with the host page — the page's JavaScript can read and modify the extension's variables, and vice versa. A compromised or malicious page can tamper with the extension's logic directly, override its functions, or read any data it has loaded. OWASP A03 (Injection) governs this. Chrome's ISOLATED world is the default for a reason: it creates a separate JavaScript environment, preventing the host page from accessing or polluting the extension's execution context. The Chrome content script documentation makes this the required default.

Remove any world: "MAIN" declarations from your content_scripts entries in manifest.json. Omitting the world property defaults to ISOLATED, which is correct.

{
  "content_scripts": [{
    "matches": ["https://example.com/*"],
    "js": ["content.js"]
  }]
}

If you need to expose a function to the page's JavaScript, use window.postMessage from the isolated content script — the page sends a message, the content script receives and validates it, then responds.