yea your right, i have addressed this by moving the api from the window object to a dev tools panel page & options page of the extension so the website itself is no longer able to communicate to the service worker of the extension that is opening up the bridge to access all tabs
https://github.com/devidw/tabgod/issues/1#issuecomment-19336...