A content script is extension code that runs in the context of a web page. It shares the page's DOM but runs in an isolated world, so the page's JavaScript variables are hidden from it and its variables are hidden from the page. It can read and change what the page displays.
What a content script is
Chrome describes content scripts as files that run in the context of web pages. Using standard DOM APIs, they can read details of the pages the browser visits, make changes to them, and pass information to their parent extension.
If you have ever seen an extension add a button to a web app, highlight text or autofill a form, a content script did that.
The isolated world
Each content script runs in a private execution environment that is not accessible to the page or to other extensions. A variable defined in a content script is not visible to the host page. The page and the script can each define a variable with the same name without conflict.
This protects the extension from page code, and the page from accidental clashes. It is not a privacy wall between the extension and the page content. Both operate on the same DOM, so a content script sees whatever is rendered or typed into the page, including form fields.
What they can call directly
Content scripts can use only a limited set of extension APIs, such as storage and runtime messaging. For anything else, they send a message to another part of the extension, typically the service worker, which holds the broader API access.
Cross origin requests are also constrained. Chrome states that content scripts run in the page's origin, so cross origin requests are always treated as such, even if the extension has host permissions. The recommended design is for the content script to ask the service worker to make the request.
Why this matters for review
When you review an extension, keep the split in mind.
- The match patterns decide where content scripts get injected.
- Content scripts see the page. That is the data exposure.
- The service worker holds the powerful APIs and the network access.
- Message passing between them is the seam where bugs hide.
Chrome's guidance for developers includes a security point worth noting: do not let content scripts pass arbitrary URLs to fetch logic, and avoid innerHTML with fetched content. A page can influence a content script, so the script must not trust it blindly.
A worked picture
A grammar checker injects a content script on every page. It reads the text you type, sends it by message to its service worker, and the worker sends it to a server. Each hop is a place where data can leave. That is why host permissions, privacy terms and the publisher matter more than the extension's polish.
Pair this with how extension service workers work.
Quick check
Can a web page read an extension's content script variables?
No. The isolated world keeps them private. The page and the script share the DOM, though, so they can exchange information through it, for example with window.postMessage.
Do content scripts need host permissions to run?
Their match patterns decide where they inject, and those patterns can trigger permission warnings.
Sources
- Content scripts (Chrome for Developers)
- Cross origin network requests (Chrome for Developers)
- Declare permissions (Chrome for Developers)
Last reviewed: 19 October 2026.
