Cross-Origin XHR in Chrome extension

问题:

I'm trying to grab some data from https://api.vk.com/ like this:

// popup.js
var client = new XMLHttpRequest();
client.open("GET", url, true);
client.onload = (function() {
  alert("okay");
});
client.send();

In manifest.json I wrote:

"permissions": [
    "http://*/*", "https://*/*"
 ]

but still have an error:

XMLHttpRequest cannot load https://api.vk.com/method/friends.get.xml?uid=1&order=hints&fields=uid,first_name,last_name,photo_50&name_case=nom Origin chrome-extension://kehhdoipnemmlpicihdpidnjjhdpjakm is not allowed by Access-Control-Allow-Origin.

Can anyone help? Thanks.