Why can Tampermonkey's GM_xmlhttpRequest perform a CORS request?

Question

GM_xmlhttpRequest can perform an ajax call that ignores the same origin policy.
I have checked the network panel in Chrome but I cannot find the XHR from GM_xmlhttpRequest in it. It just works.
I'd like to know what exactly happened and the reason why it works. Thank you.

Answer 1

Tampermonkey can do cross-origin ajax because it is an extension and extensions are trusted much more than some website's javascript. See "Referencing external resources" in the Chrome extension API.

Tampermonkey scripts operate in a privileged scope and GM_xmlhttpRequest was created specifically to wrap around a privileged XMLHttpRequest call.

To see the Tampermonkey XHR, you must inspect Tampermonkey's background page. You will see the userscript's XHR In the network panel there.