To intercept and modify the response, browser could render with your mutation

XHRMITM.js

(function () {
  const XHR = window.XMLHttpRequest;

  function newXHR () {
    var xhr = new XHR();

    xhr.addEventListener("readystatechange", () => {
      if (xhr.readyState === 4) {
        var originalResponse = JSON.parse(xhr.responseText); // store first
        Object.defineProperty(xhr, "responseText", { writable: true }); // make it writable, careful it will also clear it
        originalResponse.payload = '我改到你了'; // do what you want with the response
        xhr.responseText = JSON.stringify(originalResponse);
      }
    }, false);

    return xhr;
  }

  window.XMLHttpRequest = newXHR;
})();