Comment by robryk

You can always exfiltrate by inserting stuff into the page's DOM that will do the exfil from the page's context.