Possible way to inject javascript through content-scripts

This could perhaps be used to workaround the sandboxing issue you
discussed before.