Script Injection

Script Injection

Execute custom JavaScript in tabs that load inside temporary containers and match a domain pattern. Located under Advanced > Script Injection.

Enabling

1. Open Advanced > Script Injection.
2. Tick the security acknowledgment checkbox. Firefox requests the “Access browser activity” (webNavigation) permission.
3. Once granted, form and list become active.

Fields

• Domain Pattern: example.com or *.example.com (wildcards exclude base domain unless added separately).
• Code: JavaScript executed in the tab context.
• Run At: document_start, document_end, or document_idle (default). Choose earlier phases for DOM rewrite, later for full content.

Security Warning

Any injected code has full access to page contents, credentials already present in that DOM context, and can exfiltrate data. Only add scripts you fully trust and understand. Never paste random snippets from forums.

Storage Limits

Firefox Sync quota is small (~100KB). Large scripts may prevent preferences from syncing. Local storage has a 5MB cap for the entire extension. Keep scripts concise.

Editing & Removing

Use Edit to adjust code/runAt. Removing a script deletes only that entry; domain group remains until empty.

Use Cases

• Modify CSP‑safe inline behaviors (e.g., strip tracking query params before scripts read them).
• Set localStorage flags prior to site runtime.
• Inject small helper logging during debugging.

Better Alternatives

If a site needs large persistent scripts, consider a userscript manager extension instead of bloating container preferences.

Related

• Cookie Injection
• Per‑Domain Rules
• Privacy