title: How does same-domain policy apply to background scripts (NON-content scripts) in Firefox and Chrome extensions?
body: <p>To my understanding, there are two types of scripts in an extension, one is "content scripts" that run from, and interact with DOM in webpages, which are governed by the same origin policy; the other are scripts, call them <strong>"extension scripts"</strong>, that run in the background and may or may not interact with webpages, like <em>main.js</em> in Firefox or <em>background.js</em> in Chrome. Here is Google's explanation for extension scripts</p>
  
  <blockquote>
    <p>"...have a single long-running script to manage some task or state ...the background page is an HTML page that runs in the extension process. It exists for the lifetime of your extension, and only one instance of it at a time is active"</p>
  </blockquote>
  
  <p>So the question is, how does same-origin policy apply to <strong>"extension scripts"</strong>? And why should it, since these scripts are independent from contents on the webpage that is being viewed? What is the <em>domain</em> of an extension script anyway? (Google says <a href="https://developer.chrome.com/extensions/xhr.html" rel="nofollow">"extension attempts to use a security origin other than itself"</a>, but doesn't explicitly state what the origin is.)</p>
  
  <p>Could the following be done in an extension?</p>
  
  <p>Example one : get the time from a time server, and display it on the add-on bar. </p>
  
  <p>Example two : an extension that checks whether a recently closed page from an arbitrary domain (or a bookmarked but closed page) is updated, and alert the user if it is.</p>
  
  <hr>
  
  <p>I know cross domain HTTP and Ftp requests in Chrome can be accomplished by using XMLHttpRequest after declaring permissions Http://*/. But what about Firefox? What about other protocols, like smtp, ppp, etc? </p>
  
  <p>Is WebSocket in HTML5, used in an extension script, shackled by the same-domain policy?   </p>