I found out that you can perform a CORS request within a Tampermonkey script using GM_xmlhttpRequest(). Unfortunately, they don't appear in the Chrome devtools network tab.
I know GM_ functions are running in their own scope somewhere within the extension.
Is there a way to inspect such requests?