Use WebFrame::setIsolatedWorldSecurityOrigin to allow cross-origin XHRs in content scripts.

chrome/test/data/extensions/api_test/cross_origin_xhr/content_script/content_script.js

Index: chrome/test/data/extensions/api_test/cross_origin_xhr/content_script/content_script.js
diff --git a/chrome/test/data/extensions/api_test/cross_origin_xhr/content_script/content_script.js b/chrome/test/data/extensions/api_test/cross_origin_xhr/content_script/content_script.js
new file mode 100644
index 0000000000000000000000000000000000000000..a368d0f737822b9bacc7cdd5e67f10094d9042c5
--- /dev/null
+++ b/chrome/test/data/extensions/api_test/cross_origin_xhr/content_script/content_script.js
@@ -0,0 +1,25 @@
+chrome.extension.onRequest.addListener(
+  function(url, sender, sendResponse) {
+    var req = new XMLHttpRequest();
+    console.log('Requesting url: ' + url);
+    req.open('GET', url, true);
+
+    req.onload = function() {
+      sendResponse({
+        'event': 'load',
+        'status': req.status,
+        'text': req.responseText
+      });
+    };
+    req.onerror = function() {
+      sendResponse({
+        'event': 'error',
+        'status': req.status,
+        'text': req.responseText
+      });
+    };
+
+    req.send(null);
+  });
+
+chrome.extension.sendRequest('injected');