javascript bookmarklet are isolated from other scripts?

Question

Using DOM, I am able to write a script that read (and potentially assign to a variable) the code of the other scripts in the current page, isn't it?

Is it possible to do the same thing for bookmarklets? That is, could a inline or external script in the current web page read (and potentially assign to a variable) the source code of a bookmarklet that is executed after the loading of the page, or access any variable and/or property of such bookmarklet?

Answer 1

Did you try it and see what happens? Seems easy to make a test page. Answer is yes it can change values, it is not like code runs in sandboxes.

Answer 2

Why, no! They are not at all, thats why bookmarklets are so powerful. Bookmarklets are simply javascript: URLs executing in global scope and have full control on current window

Lets hijack window.open() method for example:

javascript:(function(){var wo=window.open;window.open=function(){if(confirm('All your window.open are belong to us!'))return wo.apply(window, arguments)}})()

So, the following popup is under our full control now:

javascript:with(window.open()){document.open('text/plain');document.write('HAI!');document.close()}