What

The injected script should not depend on global JavaScript objects, such as Set and Map.

Why

Websites under test can overwrite these objects, leading to unexpected behavior.

Example

One website can overwrite Set with a simple function like this:

function Set() {
    ...
}

The injected script would then use the function above while it was expecting a native Set object here, leading to unexpected issues, like throwing exceptions when it shouldn't have.

A list of remaining globals to work on

• DataTransfer
• File
• Event
• MouseEvent
• KeyboardEvent
• TouchEvent
• PointerEvent
• FocusEvent
• DragEvent
• Symbol

Suggestion

A much better solution could be to sandbox the injected script somehow instead of using the native objects and types provided by Chrome. For example, importing a JavaScript library for these native functions might be a solution.