[jonny_eh]

But Angular only reads HTML that it's told to read, specified by the "ng-app" attribute/directive.

[bzbarsky]

Yes, but in a browser extension context the web page controls the HTML involved and is the thing you want to defend against. So relying on the HTML to play nice is not OK.

[Disclaimer: I work for Mozilla.]

[AgentME]

And the webpage can place the ng-app directive into itself.