If you really wanted to you could roll your own browser with an Electron core - you'd be able to inject stuff there willy-nilly.

At work we instrument our puppeteer (headless chrome scripted) tests so that it basically sumps out the Dom and other important rendering things. I then wrote a tool that lets one step through the dump with an interactive timeline showing the current state of the page along with console events, user generated events, etc.

So the power is there if you want to get your hands really, really dirty.