Use WebFrame::setIsolatedWorldSecurityOrigin to allow cross-origin XHRs in content scripts.

chrome/renderer/extensions/extension_dispatcher.cc

 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/renderer/extensions/extension_dispatcher.h"
 
 #include "base/command_line.h"
 #include "chrome/common/child_process_logging.h"
 #include "chrome/common/chrome_switches.h"
 #include "chrome/common/extensions/extension.h"
@@ skipping 200 matching lines @@
   UpdateActiveExtensions();
 
   const Extension* extension = extensions_.GetByID(extension_id);
   if (!extension)
     return;
 
   if (is_webkit_initialized_)
     InitHostPermissions(extension);
 }
 
+// static
 void ExtensionDispatcher::InitHostPermissions(const Extension* extension) {
   if (extension->HasApiPermission(Extension::kManagementPermission)) {
     WebSecurityPolicy::addOriginAccessWhitelistEntry(
         extension->url(),
         WebString::fromUTF8(chrome::kChromeUIScheme),
         WebString::fromUTF8(chrome::kChromeUIExtensionIconHost),
         false);
   }
 
   const URLPatternList& permissions = extension->host_permissions();
@@ skipping 33 matching lines @@
   child_process_logging::SetActiveExtensions(active_extensions);
 }
 
 void ExtensionDispatcher::RegisterExtension(v8::Extension* extension,
                                             bool restrict_to_extensions) {
   if (restrict_to_extensions)
     restricted_v8_extensions_.insert(extension->name());
 
   RenderThread::current()->RegisterExtension(extension);
 }