Maybe are there some settings to disable this in extension context. Since I'm developing an extension it should be my own responsibility to not shoot my own goal. It is very frustrating to fiddle with this security thing that is totally out of reason when developing browser extensions.
I don't want to make whole browser insecure by disabling it globally. just for the scripts that are set in "content_scripts" section in manifest.json
Your manifest.json file should have the domain you're looking to use in the permissions:
"permissions": [
"http://*.domain.com/"
]
来源：https://stackoverflow.com/questions/6051537/how-to-disable-same-origin-policy-in-chrome-extension