The feature was supposed to be the easy one. NotebookLM generates flashcards. My extension reads them off the page. You export them to Anki. I'd already built the hard-looking part — the export — so I figured reading the cards was an afternoon of work.
It took two days, and by the end I was intercepting a private Google API and peeling a 1.5MB blob apart by hand.
Here's how it started. I opened the flashcard view, hit F12, ran my scraper. Zero cards. Every selector came back empty — not wrong text, nothing. So I did the honest thing and actually looked at the DOM instead of trusting what I thought was there.
The cards render inside an iframe. And the iframe is served from a different domain — scf.usercontent.goog, if you want the specifics. That's the same-origin policy doing exactly what it's built to do: my code runs on notebooklm.google.com, and the browser flatly refuses to let it reach into a frame from another origin. I could see the cards with my own eyes. My script was standing on the wrong side of a wall it isn't allowed to climb.
Two ways over that wall. One: inject a script directly into the iframe and read it from the inside. Two: forget the iframe entirely and catch the data on the network, before it ever gets there. Because the main page has to fetch that flashcard data from somewhere to build the iframe in the first place.
