Options for communicating between Chrome Extension and Embedding Page's Javascript

I am monitoring browser events such as when a new tab is created. My extension needs to display these browser events in the new tab page.

To make versioning easier I would like the extension to be as dumb as possible. That is, all it needs to do is tell me is that a tab has been created and I need to be able to tell the extension to switch to a tab. Then I do not have to worry about what extension versions people have installed.

The new tab page so far is a redirect to my single-page app hosted on my server.

My options seem to be:

1. Using custom events to send messages between the content script and embedding page: http://code.google.com/chrome/extensions/content_scripts.html#host-page-communication

   This seems like a security risk as the page javascript will also have access to 开发者_StackOverflow中文版the DOM and hence the messages I am exchanging.

2. Loading the HTML from server into an iframe, pulling application JS from server and injecting it into the iframe as a contentscript. This allows the app's JS to have full access to the chrome extension API which is what I need.

Another consideration is that my project is currently using RequireJS. For option 2, it seems I won't be able to use this.

Can anyone recommend the preferred option keeping in mind the security risks of option 1?

Will I be able to use RequireJS with option 2?

Is there another way to acheive this?