While content scripts (in the extension world, meaning scripts running in the context of a content page) shares the DOM with the untrusted page, it does not share the JavaScript wrapper layer around that DOM. This is extra confusing because the global object is a (JavaScript wrapper around a) DOM object.

The untrusted script can override its own view of createElement, but not the extension's view.

Even if it is a content script its still not possible. https://developer.chrome.com/extensions/content_scripts#exec...

My understanding is that the content script can access the webpage DOM, but not the other way around (it's a "one way street", if you will)