The popover doesn't have access to safari.application
so can't get the current URL directly, but it can call functions in the global page which can.
In your global page:
function currentUrl() {
return safari.application.activeBrowserWindow.activeTab.url;
}
Then in the popover:
alert(safari.extension.globalPage.contentWindow.currentUrl());
Ensure that the Access Level is set to 'All' in the Extension builder and secure pages are included otherwise the URL will sometimes be undefined.