chrome-ext-security

Chrome Extension Security

MV3 enforces a strict security model. All executable code must be bundled locally. The Content Security Policy bans eval() and remote scripts. Content scripts operate in an isolated world but share a DOM with potentially hostile pages. The service worker is the trusted core — all messages from content scripts must be validated.

Hard Security Rules

Remote Code Ban

All executable JavaScript must be bundled locally within the extension package. No fetching scripts from CDNs, no dynamically loaded SDKs. Violating this triggers Blue Argon CWS rejection.

eval() and String-to-Code Prohibition

These are banned in standard extension contexts:

• eval()
• new Function(string)
• setTimeout(string) / setInterval(string)

Escape hatches for legitimate needs:

• userScripts API (Chrome 120+) for user script managers
• Sandboxed iframes (no Chrome API access)
• wasm-unsafe-eval in CSP for WebAssembly

Content Security Policy (MV3)

Declared as an object (not a string). No remote domains in script-src, worker-src, object-src, or style-src:

{
  "content_security_policy": {
    "extension_pages": "script-src 'self'; object-src 'self'",
    "sandbox": "sandbox allow-scripts; script-src 'self' 'unsafe-eval'"
  }
}

Code Obfuscation Ban

Standard minification (whitespace removal, variable shortening) is allowed. Base64 encoding logic, character encoding to hide functionality, or other obfuscation triggers Red Titanium rejection.

Trust Boundaries

Content Scripts Are Untrusted

Content scripts share an execution environment with potentially malicious web pages. The service worker must:

• Validate and sanitize ALL messages received from content scripts
• Never pass content script data to eval(), innerHTML, or other injection sinks
• Treat content script messages like untrusted user input at an API boundary

DOM Injection Safety

When injecting UI into web pages:

• Use textContent or innerText instead of innerHTML for text
• Use document.createElement() for DOM construction
• Enforce Trusted Types API when handling HTML
• Mount injected UI inside Shadow DOM to isolate from host page

Network Request Security

• Content script fetch() calls are subject to host page CSP
• Proxy sensitive network requests through the service worker
• Use HTTPS for all data transmission
• Never put sensitive data in URL query parameters or headers (leaks into server logs)

Third-Party Library Risks

NPM packages may internally use eval() or new Function(). This violates MV3 CSP and causes CWS rejection. Audit dependencies for:

• Dynamic code execution
• Inline script injection
• Remote resource loading

Isolate unavoidable dynamic code in sandboxed iframes.

Additional Resources

Reference Files

• references/csp-rules.md — Complete CSP configuration guide for MV3 extensions
• references/dom-safety.md — Detailed DOM injection patterns, Trusted Types, and XSS prevention