Take the 2-minute tour ×

This is a hypothetical question:

I want to build a Chrome extension that'll track a user's clicks on a subset of webpages where the extension is active, and send data as a POST or GET request via AJAX to an external server I have running somewhere. Is this possible at all, because it sounds like XSS to me? If it is XSS, are there any workarounds?

Thanks in advance for your help.

Edit: To clarify, this question was posed to monitor the clicks within the widget.

share|improve this question
This is hypothetically can be a law issue with real punishment –  zerkms Nov 2 '12 at 23:27
How/why? I'm basically injecting a small HTML form into the Bing homepage, and want to know what data the user submits on that form, what buttons they're clicking on, etc. –  khalid13 Nov 2 '12 at 23:30
I'm sure this is privacy violation –  zerkms Nov 2 '12 at 23:31
This is completely possible; see How does Same Origin Policy apply to browser extensions? (Short answer: it doesn't, really.) –  apsillers Nov 19 '12 at 18:01
@khalid13 Do you seriously not see the tremendous privacy violation such an extension introduces? It seems to fit the definition of spyware quite nicely. Even if you operate with user consent (e.g., users are somehow okay with you collecting their entire search history), you'd still have a legal responsibility in many nations to protect the data you collect from outside eyes. –  apsillers Nov 19 '12 at 18:06

1 Answer 1

up vote 2 down vote accepted

This isn't a hypothetical answer *:

A chrome extension ... "can talk to remote servers outside of its origin, as long as it first requests cross-origin permissions."

Source and instructions: Cross-Origin XMLHttpRequest

* ... but you should take note of the comments concerning privacy and legality before implementing this!

share|improve this answer

Your Answer


