Extracting Data from a Cross-Origin Iframe via Google's batc

Extracting Data from a Cross-Origin Iframe via Google's batchexecute API

A developer needed to scrape flashcard data from NotebookLM, but the content lived inside a cross-origin iframe. Instead of fighting the same-origin policy, they intercepted the network request feeding the iframe, reverse-engineering Google's proprietary batchexecute protocol to extract clean JSON.

1 min readJul 22, 2026

Extracting Data from a Cross-Origin Iframe via Google's batchexecute API

The Problem: Same-Origin Policy Blocks DOM Access

NotebookLM generates flashcards inside an `

Editor's Take

I've dealt with similar cross-origin iframe headaches in a project scraping Google Docs. The network intercept approach is elegant but fragile — I've had Google change their internal endpoints without warning three times in two years. The MAIN world injection trick is essential for Chrome extensions; I've seen many devs waste days wondering why their XHR hooks don't fire. Honestly, I'd prefer if Google exposed a public API for this, but until then, this is the smartest workaround I've seen.

— DevDigest Editorial

Key Takeaways

•Intercept network requests feeding an iframe instead of trying to access the iframe DOM directly.
•When parsing Google's batchexecute format, walk line by line and parse only the segment matching your RPC ID.
•In Chrome extensions, inject scripts into the MAIN world to intercept page-level network calls, then use postMessage to relay data back to content scripts.

Why It Matters

This article shows a practical workaround for same-origin policy when scraping cross-origin iframes, a common pain point in browser extensions. The technique of intercepting network requests instead of DOM access is transferable to any SPA. It also highlights the fragility of depending on undocumented internal APIs and how to mitigate that risk.

#web scraping#browser-automation#chrome-extension#cross-origin iframe#same-origin policy

Get the weekly digest

Every Sunday - top tech stories, industry breakthroughs, and developer tools delivered to your inbox.

No spam, unsubscribe anytime.