Cross-Origin issue with iFrame for chrome extension

Question

I am trying to write a chrome extension for auto-dialing in Google Hangouts so I don't have to enter my conference bridge number for every meeting. Would be nice to have them saved too...anyway, I have the concept sort-of working but I'm trying to get around a cross-origin issue.

When you make a call in Google Hangouts, you start at the contact page and enter the number you want to dial. When you hit enter or click "make call", the dialer is loaded in an iFrame. In my chrome extension, I am able to get a reference to the iFrame however the Frame is under the domain "plus.google.com", and my script is accessing from "hangouts.google.com".

I know they are both under the google.com parent domain, so I'm trying to allow my chrome extension access to the Frame in order to execute .click() on the dialer buttons within the frame's contentWindow.

In my content script in the chrome extensions, I select the iframe element from the parent page and set to a variable called iframe.

var iframe = $("div iframe")[0];

I can set

document.domain = "google.com";

without issues, but when I try to do

iframe.contentWindow.document.domain = "google.com";

I get

content.js:3 Uncaught SecurityError: Blocked a frame with origin 
"https://hangouts.google.com" from accessing a frame with origin 
"https://plus.google.com". The frame requesting access set "document.domain" to 
"google.com", but the frame being accessed did not. Both must set 
"document.domain" to the same value to allow access.

I've tried relaxing the content security policy in the extension, but maybe I'm not doing it right:

  "content_security_policy": "script-src 'self' https://google.com; object-src 'self'",
  "permissions": [
    "http://*/",
    "tabs"
  ]

Is there a way I can get around this?

Answer 1

Adding permissions or relaxing CSP will not help in this case.

You need a second instance of a content script in the iframe to manipulate its document cross-domain.

Make sure you inject your content script with "all_frames": true.

You can communicate between content scripts using iframe.contentWindow.postMessage.