Suppose there is a trusted browser extension in a chrome browser that modifies the web page (like editing DOM, appending scripts, etc)
I don't want anyone but me to see the page modified by this extension, as it could now contain sensitive data. Though it is possible for js handlers to reflect the modified page back to the server. Problem 1: How can I isolate the modified page?
On the other hand it is important for the given page to allow outgoing connections to dynamically load and update the page content.
There is no way I could filter the traffic of the page from the untrusted server (It is served from an untrusted source. The traffic is encrypted, protocol is unknown and could change) Problem 2: How not to break dynamic page updates?
Basically, I need at least one-way isolation of page. The browser extension should be capable of doing whatever it needs, and nothing should the page scripts be allowed to do with browser extension content.