Use WebFrame::setIsolatedWorldSecurityOrigin to allow cross-origin XHRs in content scripts.

chrome/renderer/extensions/extension_dispatcher.h

Index: chrome/renderer/extensions/extension_dispatcher.h
diff --git a/chrome/renderer/extensions/extension_dispatcher.h b/chrome/renderer/extensions/extension_dispatcher.h
index bce3c0fb5e109e5f064d37fcf4e4ae6ef59cbb72..121584ebc00aaf97fff0a01819c94c043cdb404f 100644
--- a/chrome/renderer/extensions/extension_dispatcher.h
+++ b/chrome/renderer/extensions/extension_dispatcher.h
@@ -52,6 +52,9 @@ class ExtensionDispatcher : public RenderProcessObserver {
                             const std::string& v8_extension_name,
                             int extension_group);
 
+  // Sets up the host permissions for |extension|.
+  static void InitHostPermissions(const Extension* extension);
+
  private:
   friend class RenderViewTest;
 
@@ -81,9 +84,6 @@ class ExtensionDispatcher : public RenderProcessObserver {
   // extension is for Chrome Extensions only.
   void RegisterExtension(v8::Extension* extension, bool restrict_to_extensions);
 
-  // Sets up the host permissions for |extension|.
-  void InitHostPermissions(const Extension* extension);
-
   // True if this renderer is running extensions.
   bool is_extension_process_;