diff --git a/package.json b/package.json
index 342342b..2cd3bfe 100644
--- a/package.json
+++ b/package.json
@@ -25,7 +25,7 @@
     "eslint-plugin-prettier": "^3.1.3",
     "eslint-plugin-vue": "^6.2.2",
     "prettier": "^1.19.1",
-    "vue-cli-plugin-browser-extension": "latest",
+    "vue-cli-plugin-browser-extension": "^0.25.1",
     "vue-template-compiler": "^2.6.11"
   },
   "_id": "iitc-button@0.1.0",
diff --git a/public/assets/iconfont/material-icons.css b/public/assets/iconfont/material-icons.css
index dd93f51..79b442f 100644
--- a/public/assets/iconfont/material-icons.css
+++ b/public/assets/iconfont/material-icons.css
@@ -5,9 +5,7 @@
   font-family: 'Material Icons';
   font-style: normal;
   font-weight: 400;
-  src: local('Material Icons'),
-       local('MaterialIcons-Regular'),
-       url(MaterialIcons-Regular.woff2) format('woff2');
+  src: url(MaterialIcons-Regular.woff2) format('woff2');
 }
 
 .material-icons {
diff --git a/src/background/background.js b/src/background/background.js
index 9f944e5..fc755ad 100644
--- a/src/background/background.js
+++ b/src/background/background.js
@@ -27,6 +27,9 @@ browser.runtime.onMessage.addListener(async request => {
     case "toggleIITC":
       await onToggleIITC(request.value);
       break;
+    case "xmlHttpRequestHandler":
+      await xmlHttpRequestHandler(request.value);
+      break;
   }
 });
 
@@ -59,3 +62,38 @@ browser.runtime.onMessage.addListener(function(request) {
       break;
   }
 });
+
+async function xmlHttpRequestHandler(data) {
+  async function xmlResponse(tab_id, callback, response) {
+    const injectedCode = `
+    document.dispatchEvent(new CustomEvent('onXmlHttpRequestHandler', {
+      detail: JSON.stringify({
+        callback: "${String(callback)}",
+        response: ${String(response)}
+      })
+    }));
+  `;
+
+    try {
+      await browser.tabs.executeScript(data.tab_id, {
+        code: injectedCode
+      });
+    } catch (error) {
+      console.error(`An error occurred while execute script: ${error.message}`);
+    }
+  }
+
+  const req = new XMLHttpRequest();
+  req.onload = function() {
+    const response = {
+      readyState: this.readyState,
+      responseHeaders: this.responseHeaders,
+      responseText: this.responseText,
+      status: this.status,
+      statusText: this.statusText
+    };
+    xmlResponse(data.tab_id, data.onload, JSON.stringify(response));
+  };
+  req.open(data.method, data.url, true, data.user, data.password);
+  req.send();
+}
diff --git a/src/background/injector.js b/src/background/injector.js
index e593d70..71f8391 100644
--- a/src/background/injector.js
+++ b/src/background/injector.js
@@ -1,17 +1,18 @@
 //@license magnet:?xt=urn:btih:1f739d935676111cfff4b4693e3816e664797050&dn=gpl-3.0.txt GPL-v3
 export async function injectUserScript(code, tabs) {
-  const inject = `
+  if (tabs === undefined) tabs = await getTabsToInject();
+
+  for (let tab of Object.values(tabs)) {
+    const inject = `
     document.dispatchEvent(new CustomEvent('IITCButtonInitJS', {
-      detail: ${JSON.stringify(code)}
+      detail: ${JSON.stringify({ code: code, tab_id: tab.id })}
     }));
   `;
 
-  if (tabs === undefined) tabs = await getTabsToInject();
-
-  for (let tab of Object.values(tabs)) {
     try {
       await browser.tabs.executeScript(tab.id, {
-        code: inject
+        code: inject,
+        runAt: "document_end"
       });
     } catch (error) {
       console.error(`An error occurred while reloading tabs: ${error.message}`);
diff --git a/src/background/intel.js b/src/background/intel.js
index 2340e58..846571f 100644
--- a/src/background/intel.js
+++ b/src/background/intel.js
@@ -1,5 +1,4 @@
 //@license magnet:?xt=urn:btih:1f739d935676111cfff4b4693e3816e664797050&dn=gpl-3.0.txt GPL-v3
-import { getUID, parse_meta, preparationUserScript } from "../helpers";
 import { getTabsToInject, injectUserScript } from "./injector";
 
 let lastIITCTab = null;
@@ -63,9 +62,6 @@ async function initialize() {
     "release_iitc_code",
     "test_iitc_code",
     "local_iitc_code",
-    "release_iitc_version",
-    "test_iitc_version",
-    "local_iitc_version",
     "release_plugins_flat",
     "test_plugins_flat",
     "local_plugins_flat",
@@ -81,7 +77,6 @@ async function initialize() {
 
   const status = data["IITC_is_enabled"];
   const iitc_code = data[channel + "_iitc_code"];
-  const iitc_version = data[channel + "_iitc_version"];
 
   const plugins_local = data[channel + "_plugins_local"];
   const plugins_user = data[channel + "_plugins_user"];
@@ -90,32 +85,19 @@ async function initialize() {
     const tabs = await getTabsToInject();
     const userscripts = [];
 
-    const iitc_meta = parse_meta(iitc_code);
-    const iitc_uid = getUID(iitc_meta);
-    const inject_iitc_code = preparationUserScript(
-      {
-        version: iitc_version,
-        code: iitc_code
-      },
-      iitc_uid
-    );
-    userscripts.push(inject_iitc_code);
-
     const plugins_flat = data[channel + "_plugins_flat"];
     for (const uid of Object.keys(plugins_flat)) {
       if (plugins_flat[uid]["status"] === "on") {
         userscripts.push(
-          preparationUserScript(
-            plugins_flat[uid]["user"] === true
-              ? plugins_user[uid]
-              : plugins_local[uid],
-            uid
-          ),
-          tabs
+          plugins_flat[uid]["user"] === true
+            ? plugins_user[uid]["code"]
+            : plugins_local[uid]["code"]
         );
       }
     }
 
+    userscripts.push(iitc_code);
+
     await Promise.all(userscripts.map(code => injectUserScript(code, tabs)));
   }
 }
diff --git a/src/background/manager.js b/src/background/manager.js
index bb98597..af9afc8 100644
--- a/src/background/manager.js
+++ b/src/background/manager.js
@@ -1,14 +1,6 @@
 //@license magnet:?xt=urn:btih:1f739d935676111cfff4b4693e3816e664797050&dn=gpl-3.0.txt GPL-v3
 
-import {
-  _,
-  ajaxGet,
-  clearWait,
-  getUID,
-  parse_meta,
-  preparationUserScript,
-  wait
-} from "../helpers";
+import { _, ajaxGet, clearWait, getUID, parseMeta, wait } from "../helpers";
 import { on_extension_update } from "./extension";
 import { injectUserScript } from "./injector";
 
@@ -303,7 +295,7 @@ async function updateExternalPlugins(local) {
         // download meta info
         const response_meta = await getUrl(plugin["updateURL"] + hash);
         if (response_meta) {
-          let meta = parse_meta(response_meta);
+          let meta = parseMeta(response_meta);
           // if new version
           if (
             meta &&
@@ -377,12 +369,9 @@ export async function managePlugin(uid, category, action) {
       }
 
       await injectUserScript(
-        preparationUserScript(
-          plugins_flat[uid]["user"] === true
-            ? plugins_user[uid]
-            : plugins_local[uid],
-          uid
-        )
+        plugins_flat[uid]["user"] === true
+          ? plugins_user[uid]["code"]
+          : plugins_local[uid]["code"]
       );
 
       await save({
@@ -400,7 +389,7 @@ export async function managePlugin(uid, category, action) {
         plugins_local[uid] = plugins_flat[uid];
         plugins_local[uid]["code"] = response;
 
-        await injectUserScript(preparationUserScript(plugins_local[uid], uid));
+        await injectUserScript(plugins_local[uid]["code"]);
 
         await save({
           plugins_flat: plugins_flat,
diff --git a/src/choose_file/BlockDrop.vue b/src/choose_file/BlockDrop.vue
index ad7a790..5d9f751 100644
--- a/src/choose_file/BlockDrop.vue
+++ b/src/choose_file/BlockDrop.vue
@@ -32,7 +32,7 @@
 </template>
 
 <script>
-import { _, parse_meta } from "../helpers";
+import { _, parseMeta } from "../helpers";
 
 /*
  * Validation UserScript and adding to IITC Button
@@ -45,7 +45,7 @@ const processingFile = async fileList => {
 
     try {
       const code = await readUploadedFileAsText(file);
-      const meta = parse_meta(code);
+      const meta = parseMeta(code);
 
       if (meta === {} || meta["name"] === undefined) {
         message += _("notValidUserScript", file["name"]) + "\n";
diff --git a/src/choose_file/BlockURL.vue b/src/choose_file/BlockURL.vue
index d669bbe..0033b11 100644
--- a/src/choose_file/BlockURL.vue
+++ b/src/choose_file/BlockURL.vue
@@ -22,7 +22,7 @@
 </template>
 
 <script>
-import { _, ajaxGet, parse_meta } from "../helpers";
+import { _, ajaxGet, parseMeta } from "../helpers";
 
 export default {
   name: "BlockURL",
@@ -52,7 +52,7 @@ export default {
       if (code) {
         const scripts = [];
         let message = "";
-        const meta = parse_meta(code);
+        const meta = parseMeta(code);
         const filename = url.substr(url.lastIndexOf("/") + 1);
 
         if (meta === {} || meta["name"] === undefined) {
diff --git a/src/content-scripts/gm-api.js b/src/content-scripts/gm-api.js
new file mode 100644
index 0000000..6682537
--- /dev/null
+++ b/src/content-scripts/gm-api.js
@@ -0,0 +1,132 @@
+//@license magnet:?xt=urn:btih:1f739d935676111cfff4b4693e3816e664797050&dn=gpl-3.0.txt GPL-v3
+export const GM = function() {
+  window.GM = function(dataKey, tab_id, meta) {
+    return {
+      info: {
+        script: meta
+      },
+      _getValueSync: function(key, default_value) {
+        if (!this._access("getValue")) return undefined;
+
+        const items = sessionStorage.getItem(dataKey + "_" + key);
+        if (items !== null) {
+          return JSON.parse(items);
+        } else {
+          return default_value;
+        }
+      },
+      getValue: function(key, default_value) {
+        return new Promise((resolve, reject) => {
+          if (!this._access("getValue")) return reject;
+          resolve(this._getValueSync(key, default_value));
+        });
+      },
+      setValue: function(key, value) {
+        return new Promise((resolve, reject) => {
+          if (!this._access("setValue")) return reject;
+
+          sessionStorage.setItem(dataKey + "_" + key, JSON.stringify(value));
+          resolve();
+        });
+      },
+      deleteValue: function(key) {
+        return new Promise((resolve, reject) => {
+          if (!this._access("deleteValue")) return reject;
+
+          sessionStorage.removeItem(dataKey + key);
+          resolve();
+        });
+      },
+      listValues: function() {
+        return new Promise((resolve, reject) => {
+          if (!this._access("listValues")) return reject;
+
+          let keys = [];
+          let prelen = "Vm123".length;
+          for (let key of Object.keys(sessionStorage)) {
+            if (key.substr(0, prelen) === dataKey) {
+              keys.push(key.substr(prelen + 1));
+            }
+          }
+          resolve(keys);
+        });
+      },
+      getResourceUrl: function() {
+        return new Promise((resolve, reject) => {
+          if (!this._access("getResourceUrl")) return reject;
+        });
+      },
+      openInTab: function() {},
+      notification: function() {},
+      setClipboard: function() {},
+      xmlHttpRequest: function(details) {
+        let data = Object.assign(
+          {
+            binary: false,
+            context: {},
+            data: null,
+            headers: {},
+            method: null,
+            overrideMimeType: null,
+            url: null,
+            user: null,
+            password: null,
+            timeout: 0,
+            onabort: null,
+            onerror: null,
+            onload: null,
+            onprogress: null,
+            onreadystatechange: null,
+            ontimeout: null
+          },
+          details
+        );
+
+        for (let key in data) {
+          if (key.startsWith("on")) {
+            data[key] = String(data[key]);
+          }
+        }
+
+        data.tab_id = tab_id;
+
+        document.dispatchEvent(
+          new CustomEvent("xmlHttpRequestBridge", {
+            detail: data
+          })
+        );
+      },
+      _access: function(key) {
+        console.log("_access");
+        return (
+          meta.grant !== undefined &&
+          meta.grant.some(permission => {
+            return permission.substr(3) === key;
+          })
+        );
+      }
+    };
+  };
+  document.addEventListener("onXmlHttpRequestHandler", function(e) {
+    function parseFunction(str) {
+      var fn_body_idx = str.indexOf("{"),
+        fn_body = str.substring(fn_body_idx + 1, str.lastIndexOf("}")),
+        fn_declare = str.substring(0, fn_body_idx),
+        fn_params = fn_declare.substring(
+          fn_declare.indexOf("(") + 1,
+          fn_declare.lastIndexOf(")")
+        ),
+        args = fn_params.split(",");
+      args.push(fn_body);
+      function Fn() {
+        return Function.apply(this, args);
+      }
+      Fn.prototype = Function.prototype;
+      return new Fn();
+    }
+
+    const detail = JSON.parse(e.detail);
+    const callback = parseFunction(detail.callback);
+    callback(detail.response);
+  });
+};
diff --git a/src/content-scripts/loader.js b/src/content-scripts/loader.js
index f28f5ba..3b3f68d 100644
--- a/src/content-scripts/loader.js
+++ b/src/content-scripts/loader.js
@@ -1,68 +1,79 @@
 //@license magnet:?xt=urn:btih:1f739d935676111cfff4b4693e3816e664797050&dn=gpl-3.0.txt GPL-v3
-const loaded_plugins = [];
-let sandbox = "window.plugin = {};window.plugin.missions = true;";
+import { getUID, getUniqId, parseMeta } from "../helpers";
+import { GM } from "./gm-api";
 
-function getPlayerData() {
-  if (window.wrappedJSObject) {
-    window.PLAYER = window.wrappedJSObject.PLAYER;
-  } else {
-    // Chrome does not provide access to WINDOW.
-    // Old IITC code is used to retrieve user data.
-    const scr = document.getElementsByTagName("script");
-    let d;
-    for (let x in scr) {
-      let s = scr[x];
-      if (s.src) continue;
-      if (s.type !== "text/javascript") continue;
-      d = s.innerHTML.split("\n");
-      break;
-    }
+const loaded_plugins = [];
 
-    if (!d) {
-      // page doesn’t have a script tag with player information.
-      if (document.getElementById("header_email")) {
-        // however, we are logged in.
-        // it used to be regularly common to get temporary 'account not enabled' messages from the intel site.
-        // however, this is no longer common. more common is users getting account suspended/banned - and this
-        // currently shows the 'not enabled' message. so it's safer to not repeatedly reload in this case
-        // setTimeout('location.reload();', 3*1000);
-        throw "Page doesn't have player data, but you are logged in.";
-      }
-      // FIXME: handle nia takedown in progress
-      throw "Couldn't retrieve player data. Are you logged in?";
-    }
+document.addEventListener("DOMContentLoaded", function() {
+  window.onload = function() {};
+  document.body.onload = function() {};
+});
 
-    for (let i = 0; i < d.length; i++) {
-      if (!d[i].match("var PLAYER = ")) continue;
-      sandbox += d[i] + "window.PLAYER = PLAYER;";
-      break;
-    }
-  }
+function inject(code) {
+  const script = document.createElement("script");
+  script.appendChild(document.createTextNode(code));
+  (document.body || document.head || document.documentElement).appendChild(
+    script
+  );
+  script.parentElement.removeChild(script);
 }
 
 function preparePage() {
-  const injectCode =
-    "window.onload = function() {}; document.body.onload = function() {};";
+  inject(
+    `((${GM.toString()}))()\n//# sourceURL=${browser.runtime.getURL(
+      "js/GM_api.js"
+    )}`
+  );
 
-  const script = document.createElement("script");
-  script.textContent = injectCode;
-  (document.head || document.documentElement).appendChild(script);
-
-  getPlayerData();
+  document.addEventListener("xmlHttpRequestBridge", async function(e) {
+    const data = e.detail;
+    await browser.runtime.sendMessage({
+      type: "xmlHttpRequestHandler",
+      value: data
+    });
+  });
 
   document.addEventListener("IITCButtonInitJS", function(e) {
-    const code = e.detail;
+    const tab_id = e.detail.tab_id;
+    const code = e.detail.code;
 
-    const GM_info_raw = code.substring(0, code.indexOf(";/* END GM_info */"));
-    const GM_info = new Function("GM_info", GM_info_raw + ";return GM_info")();
-    const uid = GM_info.script.uid;
+    const meta = parseMeta(code);
+    const uid = getUID(meta);
+    meta["uid"] = uid;
+
+    let dataKey = sessionStorage.getItem(uid);
+    if (!dataKey) {
+      dataKey = getUniqId("VMin");
+      sessionStorage.setItem(uid, dataKey);
+    }
 
     if (loaded_plugins.includes(uid)) {
       console.debug(`Plugin ${uid} is already loaded. Skip`);
     } else {
       loaded_plugins.push(uid);
       console.debug(`Plugin ${uid} loaded`);
-      new Function(sandbox + code)();
+
+      const name = encodeURIComponent(meta.name);
+      const injectedCode = [
+        "((GM)=>{",
+        // an implementation of GM API v3 based on GM API v4
+        "const GM_info = GM.info; const unsafeWindow = window;",
+        "const GM_getValue = (key, value) => GM._getValueSync(key, value);",
+        "const GM_setValue = (key, value) => GM._setValueSync(key, value);",
+        "const GM_xmlhttpRequest = (details) => GM.xmlHttpRequest(details);",
+
+        code,
+        // adding a new line in case the code ends with a line comment
+        code.endsWith("\n") ? "" : "\n",
+        `})(GM("${dataKey}", ${tab_id}, ${JSON.stringify(meta)}))`,
+
+        // Firefox lists .user.js among our own content scripts so a space at start will group them
+        `\n//# sourceURL=${browser.runtime.getURL(
+          "plugins/%20" + name + ".user.js"
+        )}`
+      ].join("");
+
+      inject(injectedCode);
     }
   });
 }
diff --git a/src/helpers.js b/src/helpers.js
index 15433e1..9324bc0 100644
--- a/src/helpers.js
+++ b/src/helpers.js
@@ -1,56 +1,54 @@
 //@license magnet:?xt=urn:btih:1f739d935676111cfff4b4693e3816e664797050&dn=gpl-3.0.txt GPL-v3
 export let wait_timeout_id = null;
 
+// Allow metadata lines to start with WHITESPACE? '//' SPACE
+// Allow anything to follow the predefined text of the metaStart/End
+// The SPACE must be on the same line and specifically \x20 as \s would also match \r\n\t
+// Note: when there's no valid metablock, an empty string is matched for convenience
+const METABLOCK_RE = /(?:^|\n)\s*\/\/\x20==UserScript==([\s\S]*?\n)\s*\/\/\x20==\/UserScript==|$/;
+
+const META_ARRAY_TYPES = [
+  "include",
+  "exclude",
+  "match",
+  "excludeMatch",
+  "require",
+  "grant"
+];
+
 export function _(msg, arg) {
   return browser.i18n.getMessage(msg, arg);
 }
 
-export function parse_meta(code) {
-  const meta = code.split("\n");
+export function parseMeta(code) {
+  const meta = {};
+  const metaBody = code.match(METABLOCK_RE)[1] || "";
+  metaBody.replace(
+    /(?:^|\n)\s*\/\/\x20(@\S+)(.*)/g,
+    (_match, rawKey, rawValue) => {
+      const [keyName, locale] = rawKey.slice(1).split(":");
+      const camelKey = keyName.replace(/[-_](\w)/g, (m, g) => g.toUpperCase());
+      const key = locale ? `${camelKey}:${locale.toLowerCase()}` : camelKey;
 
-  let is_userscript = false;
-  const data = {};
-  for (let i = 0; i < meta.length; i++) {
-    let line = meta[i];
-    if (line.indexOf("==UserScript==") > -1) {
-      is_userscript = true;
-      continue;
-    }
-    if (line.indexOf("==/UserScript==") > -1) {
-      return data;
-    }
-    if (is_userscript) {
-      line = line.trim();
-      const sp = line.split(/\s+/);
-
-      const key = sp[1].replace("@", "");
-      let value = sp.slice(2).join(" ");
-      if (
-        [
-          "name",
-          "namespace",
-          "category",
-          "version",
-          "description",
-          "updateURL",
-          "downloadURL",
-          "supportURL"
-        ].indexOf(key) !== -1
-      ) {
-        if (data[key]) continue;
-        if (key === "name") {
-          value = value
-            .replace("IITC plugin: ", "")
-            .replace("IITC Plugin: ", "");
+      let value = rawValue.trim();
+      if (camelKey === "name") {
+        value = value.replace("IITC plugin: ", "").replace("IITC Plugin: ", "");
+      }
+      if (META_ARRAY_TYPES.includes(key)) {
+        if (typeof meta[key] === "undefined") {
+          meta[key] = [];
         }
-        data[key] = value;
+        meta[key].push(value);
+      } else {
+        meta[key] = value;
       }
     }
-  }
-  return data;
+  );
+  // @homepageURL: compatible with @homepage
+  if (!meta.homepageURL && meta.homepage) meta.homepageURL = meta.homepage;
+  return meta;
 }
 
-/* exported ajaxGet */
 export const ajaxGet = (url, variant) =>
   new Promise((resolve, reject) => {
     const method = variant === "Last-Modified" ? "HEAD" : "GET";
@@ -79,31 +77,15 @@ export const ajaxGet = (url, variant) =>
     xhr.send(null);
   });
 
-function h(str) {
-  if (str === undefined) {
-    str = "";
-  } else {
-    str = str.replace('"', '\\"');
-  }
-  return str;
-}
-
-// Implementation of partial sufficient compatibility with GreaseMonkey
-export function preparationUserScript(plugin, uid) {
-  if (uid === undefined) uid = "";
-
-  return `var GM_info = {
-            "script": {
-              "uid": "${h(uid)}",
-              "version": "${h(plugin["version"])}",
-              "name": "${h(plugin["name"])}",
-              "description": "${h(plugin["description"])}"
-            }
-          };/* END GM_info */
-          ${plugin["code"]}; true`;
+export function getUniqId(prefix = "VM") {
+  const now = performance.now();
+  return (
+    prefix +
+    Math.floor((now - Math.floor(now)) * 1e12).toString(36) +
+    Math.floor(Math.random() * 1e12).toString(36)
+  );
 }
 
-/* exported getUID */
 export function getUID(plugin) {
   const available_fields = [];
 
diff --git a/src/jsview/App.vue b/src/jsview/App.vue
index 30d0701..bf3ed38 100644
--- a/src/jsview/App.vue
+++ b/src/jsview/App.vue
@@ -16,7 +16,7 @@
 </template>
 
 <script>
-import { _, ajaxGet, parse_meta } from "../helpers";
+import { _, ajaxGet, parseMeta } from "../helpers";
 
 export default {
   name: "App",
@@ -45,7 +45,7 @@ export default {
       this.code = code;
       this.show_header = true;
 
-      const meta = parse_meta(code);
+      const meta = parseMeta(code);
       if (meta["name"] !== undefined) {
         this.plugin_name = meta["name"];
         const filename = url.substr(url.lastIndexOf("/") + 1);
diff --git a/src/manifest.json b/src/manifest.json
index 64dab03..543b446 100644
--- a/src/manifest.json
+++ b/src/manifest.json
@@ -11,14 +11,8 @@
   "permissions": [
     "tabs",
     "storage",
-    "webNavigation",
-    "https://intel.ingress.com/*",
-    "https://iitc.app/*",
-    "http://*/*.json",
-    "http://*/*.meta.js",
-    "http://*/*.user.js",
-    "https://*/*.meta.js",
-    "https://*/*.user.js"
+    "<all_urls>",
+    "webNavigation"
   ],
   "default_locale": "en",
   "background": {
@@ -29,9 +23,10 @@
   },
   "content_scripts": [
     {
-      "matches" : ["https://intel.ingress.com/*"],
-      "run_at": "document_end",
-      "js": ["js/content-script.js"]
+      "matches" : ["<all_urls>"],
+      "run_at": "document_start",
+      "js": ["js/content-script.js"],
+      "all_frames": true
     }
   ],
   "browser_action": {