content script sandboxing of extension