Hmm, I wonder how they did that. Maybe the popup has different permissions than the iframe, or maybe they pass the selected text. Unfortunately, their code is obfuscated, but thanks for the tip.