chrome-ext-securitylisted

# Chrome Extension Security MV3 enforces a strict security model. All executable code must be bundled locally. The Content Security Policy bans `eval()` and remote scripts. Content scripts operate in an isolated world but share a DOM with potentially hostile pages. The service worker is the trusted core — all messages from content scripts must be validated. ## Hard Security Rules ### Remote Code Ban All executable JavaScript must be bundled locally within the extension package. No fetching scripts from CDNs, no dynamically loaded SDKs. Violating this triggers **Blue Argon** CWS rejection. ### eval() and String-to-Code Prohibition These are banned in standard extension contexts: - `eval()` - `new Function(string)` - `setTimeout(string)` / `setInterval(string)` **Escape hatches for legitimate needs:** - `userScripts` API (Chrome 120+) for user script managers - Sandboxed iframes (no Chrome API access) - `wasm-unsafe-eval` in CSP for WebAssembly ### Content Security Policy (MV3) Declared as an object (not a string). No remote domains in `script-src`, `worker-src`, `object-src`, or `style-src`: ```json { "content_security_policy": { "extension_pages": "script-src 'self'; object-src 'self'", "sandbox": "sandbox allow-scripts; script-src 'self' 'unsafe-eval'" } } ``` ### Code Obfuscation Ban Standard minification (whitespace removal, variable shortening) is allowed. Base64 encoding logic, character encoding to hide functionality, or other obfuscation triggers **