Are google chrome extension "content" scripts sandboxed?

Although Chrome's Content Script lives in an "isolated world", you could accomplish something similar to what you've requested by inserting a script element into the dom.

As a proof of concept, I used the TamperMonkey Chrome Extension and created this script:

// ==UserScript==// @name         Modify Secret// @namespace    http://your.homepage/// @version      0.1// @description  enter something useful// @author       You// @match        https://*/*// @match        http://*/*// @grant        none// ==/UserScript==console.log(secret);var el = document.createElement('script');el.innerHTML = 'secret = "the blue dog"';document.body.appendChild(el);

Then I navigated to http://s.codepen.io/boomerang/745009c49e60974cf9dba1b070f27d111458064000840/index.html which has this javascript running:

var secret = 'the brown fox';var secretPrinter = setInterval(function () {    console.log(secret);}, 1000);

If you inspect the console, one would expect to see 'the brown fox' constantly printed, but instead we have 'the blue dog'.

In general, I think the security concept that the browser is trying to achieve is to prevent the page's environment from accessing the content script's environment. Realizing that, it's not surprising that you could accomplish something like this with a Browser Extension.

You cannot do that. According to the documentation:

However, content scripts have some limitations. They cannot:

• Use chrome.* APIs (except for parts of chrome.extension)
• Use variables or functions defined by their extension's pages
• Use variables or functions defined by web pages or by other content scripts
• Make cross-site XMLHttpRequests