chrome.runtime is undefined in main world

[Bala Abhinav]

Hi,

I have recently added another content script to my extension which needs to run in the MAIN world for the functionality i intend to build. I am using crxjs/vite-plugin to bundle the project and crxjs typically creates a loader file where It loads the content script using chrome.runtime.getURL API.

In this case, an error is being thrown stating the following : 
TypeError: Cannot read properties of undefined (reading 'getURL')

So, I would like to understand whether chrome.runtime is not accessible to scripts loaded in the MAIN world?
For additional context, the script is loaded statically through the manifest file. The alternative solution I am considering is to inject script manually through the chrome.scripting API. Any help regarding this would be much appreciated.

Thanks,
Bala

[woxxom]

This is because the script is no longer a part of the safe isolated world, but just a conventional web page script that runs in the same JS environment as any other web page scripts, so it doesn't have any extension-specific API.

Your main world script can use messaging so that the recipient will call the required chrome API on behalf of your script (like chrome.scripting.executeScript) and optionally send the result back:

• externally_connectable messaging, see https://developer.chrome.com/docs/extensions/develop/concepts/messaging#external-webpage
• use CustomEvent DOM messaging with the second content script that runs in the default isolated world, https://stackoverflow.com/a/19312198

Note that the MAIN world is unsafe as the page may redefine a built-in prototype or a global and exfiltrate data from your private communication or make your injected code fail. Guarding against this is complicated (see Tampermonkey's or Violentmonkey's "vault"), so make sure to verify all the received data.