title: Chrome Uncaught Error: SECURITY_ERR: DOM Exception 18 when trying to XHR a file in a chrome extension
body: <p>I'm trying to request the chrome extensions manifest file (my own extension)</p>
  
  <pre><code>// MAKE MANIFEST FILE AVAILABLE
  chrome.manifest = (function() {
      var manifestObject = false;
      var xhr = new XMLHttpRequest();
      xhr.onreadystatechange = function() {
          if (xhr.readyState == 4) {
              manifestObject = JSON.parse(xhr.responseText);
          }
      };
      xhr.open("GET", chrome.extension.getURL('/manifest.json'), false);
      try {
          xhr.send();
      } catch(e) {
          log('Couldn\'t load manifest.json');
      }
      return manifestObject;
  })();
  </code></pre>
  
  <p>but I get an error:</p>
  
  <blockquote>
    <p>Uncaught Error: SECURITY_ERR: DOM Exception 18 (anonymous
    function)cm_background.js:46 (anonymous function)</p>
  </blockquote>
  
  <p>line 46 being <code>xhr.open("GET", chrome.extension.getURL('/manifest.json'), false);</code></p>
  
  <p>What would the appropriate manifest security policy be to allow me to do this, or an alternative safe way?</p>
  
  <h2>Update</h2>
  
  <h3>Manifest file</h3>
  
  <pre><code>{
    "manifest_version": 2,
    "name": "A plugin",
    "version":"1.3.6",
    "background": {
      "page":"cm_background.html"
    },
    "page_action": {
      "default_icon": "logo.png",
      "default_title": "A plugin",
      "default_popup": "cm_popup.html"
    },
    "content_scripts": [
      {
        "matches": ["http://mail.google.com/*", "https://mail.google.com/*"],
        "js": ["jquery.js",
               "underscore.js",
               "sha256.js",
               "utils.js",
               "cm_content_script.js",
               "cm_content_ui_control.js",
               "cm_first_install.js"]
      }
    ],
    "permissions" : [
      "tabs",
      "http://mail.google.com/*",
      "https://mail.google.com/*",
      "http://*/*",
      "https://*/*",
      "chrome-extension://*/*"
    ],
    "web_accessible_resources": [
      "manifest.json",
      "cm_first_install.js",
      "jquery.js",
      "cm_signature_editor.css",
      "cm_signature_editor.html"
    ],
    "content_security_policy": "default-src 'self'; style-src 'self' 'unsafe-inline'; img-src *;"
  }
  </code></pre>