javascript - Browser still leaking real user agent -

i writing privacy extension requires me spoof user agent property of browser aka navigator.useragent (yes know user-agent http header , have dealt that).

my issue page might not have main frame variable of iframes well. in manifest file using all_frames: true inject content script frames , match_about_blank: true inject frames url of "about:blank".

i using browserleaks test extension seems spoof user agent correctly using window option when using iframe.contentwindow method shows real user agent.

i believe might because iframe sandboxed , not allowed inject sandboxed iframes. huge problem since sites evade extensions , deny them access sandboxed iframe.

this error on chromium:

blocked script execution in 'about:blank' because document's frame sandboxed , 'allow-scripts' permission not set.

from chrome developer

match_about_blank:

optional. whether insert content script on about:blank , about:srcdoc. content scripts injected on pages when inherit url matched 1 of declared patterns in matches field. inherit url url of document created frame or window. content scripts cannot inserted in sandboxed frames. defaults false.

or perhaps script running in iframes including sandboxed ones script not running enough i.e. not run_at: document_start.

from mdn

match_about_blank:

match_about_blank supported in firefox version 52. note in firefox, content scripts won't injected empty iframes @ "document_start" if specify value in run_at.

my title says chrome extension going firefox too. posted documentation both mdn , chrome since wording different. on chrome when test on github.com errors regarding sandboxing on iframe on firefox no errors of such, still doesn't spoof property inside iframe want to. ideas?

manifest.json

{     "name": "shape shifter",     "version": "0.0.1",     "description": "anti browser fingerprinting web extension. generates randomised values http request headers , javascript api's.",     "manifest_version": 2,     "icons": {         "16": "icons/crossed_eye_16x16.png",         "32": "icons/crossed_eye_32x32.png",         "48": "icons/crossed_eye_48x48.png",         "128": "icons/crossed_eye_128x128.png"     },     "background": {         "persistent": true,         "scripts": ["js/background.js"]     },     "browser_action": {         "default_title": "shape shifter",         "default_icon": {             "16": "icons/crossed_eye_16x16.png",             "32": "icons/crossed_eye_32x32.png"         },         "default_popup": "html/popup.html"     },     "content_scripts": [         {             "all_frames": true,             "match_about_blank": true,             "run_at": "document_end",             "matches": ["<all_urls>"],             "js": ["js/inject.js"]         }     ],     "permissions": [         "webrequest",         "webrequestblocking",         "<all_urls>"     ],     "web_accessible_resources": [         "js/lib/seedrandom.min.js",         "js/random.js",         "js/api/document.js",         "js/api/navigator.js",         "js/api/canvas.js",         "js/api/history.js",         "js/api/battery.js",         "js/api/audio.js",         "js/api/element.js"     ] } 

inject.js (my content script)

console.log("content script running ...");  function inject(filepath, seed) {   // dynamically create script   var script = document.createelement('script');    // give script seed value use spoofing   script.setattribute("data-seed", seed);    // give script url javascript code run   script.src = chrome.extension.geturl(filepath);    // listen script loading event   script.onload = function() {     // remove script page page scripts don't see     this.remove();   };    // add script tag dom   (document.head || document.documentelement).appendchild(script); }  function getseed(origin) {     // storage object     var storage = window.sessionstorage;      // try seed sessionstorage     var seed = storage.getitem(origin);      // have seed in storage origin or not?     if (seed === null) {         // initialise 32 byte buffer         seed = new uint8array(32);          // fill cryptographically random values         window.crypto.getrandomvalues(seed);          // save storage         storage.setitem(origin, seed);     }      return seed; }  var seed = getseed(window.location.hostname);  inject("js/lib/seedrandom.min.js", seed); console.log("[info] injected seed random ...");  inject("js/random.js", seed); console.log("[info] injected random ...");  inject("js/api/document.js", seed); console.log("[info] injected document api ...");  inject("js/api/navigator.js", seed); console.log("[info] injected navigator api ...");  inject("js/api/canvas.js", seed); console.log("[info] injected canvas api ...");  inject("js/api/history.js", seed); console.log("[info] injected history api ...");  inject("js/api/battery.js", seed); console.log("[info] injected battery api ...");  inject("js/api/audio.js", seed); console.log("[info] injected audio api ...");  inject("js/api/element.js", seed); console.log("[info] injected element api ...");