If a web site has a third-party iframe on it, and the iframe is using window.postMessage to send a message to the main page, can an extension intercept the message?
I’d like to be able to check the message and depending on the content either deliver it or not.
You can try to replace DOM APIs with content scripts, which would allow you to intercept and only deliver when you want to. Essentially you’d replace postMessage in the third party iframe with a version that first does the filter check and then forwards to the original postMessage if the check passes.