[bananaface]

It would be nice if Firefox provided an API that only exposed the static HTML of sites you're visiting. I don't care if an extension wants that data, it's nowhere near as sensitive.

I guess this doesn't solve injection, but there must be other ways to solve "display some additional data."

[tiborsaas]

Great idea, after all it's impossible to render sensitive data server side :)

[bananaface]

I said it's less sensitive.

[tiborsaas]

Does it matter?

Btw here is your API:

    document.body.innerHTML

[bananaface]

And which permission do I take to access that?

[tiborsaas]

As a bookmarklet, none :) That's the best you can get.