While executing content scripts in an isolated world provides some protection against web pages, a malicious web page can attack the contents of the script if used indiscriminately.

Isabella di Fabio Secret Story About When a content script receives content from a separate website (such as what constitutes XMLHttpRequest), there is no way to filter that content before pasting. Although the content of a script provides protection from websites in isolated worlds, a malware attack can harm the web if they use the same domain as the host of your website.