EXT-003 Extension CSP allows remote code load

A browser extension's Content Security Policy allows unsafe-eval or unsafe-inline for scripts. The extension can then build or fetch code at runtime (eval(), new Function(), injected inline scripts), so marketplace review never sees the payload, and a publisher compromise reaches every user on the next browser start.

What Vulkro detects

The manifest's content_security_policy contains unsafe-eval or unsafe-inline inside a script-src or default-src directive. Manifest V3 nests the CSP under extension_pages / sandbox; both forms are checked the same way.

unsafe-inline inside style-src does not fire: runtime CSS is not a code-load primitive.

Severity High, confidence High. Evidence signal: extension-remote-code-load-csp, weight 0.9, source Pattern.

Non-compliant code

{
  "manifest_version": 2,
  "name": "Inline-friendly tool",
  "version": "1.0.0",
  "content_security_policy": "script-src 'self' 'unsafe-eval'; object-src 'self'"
}

{
  "manifest_version": 3,
  "name": "Inline-friendly tool",
  "version": "1.0.0",
  "content_security_policy": {
    "extension_pages": "script-src 'self' 'unsafe-inline'; object-src 'self'"
  }
}

Compliant code

Only scripts bundled in the package (which review reads) can run.

{
  "manifest_version": 3,
  "name": "Inline-friendly tool",
  "version": "1.0.0",
  "content_security_policy": {
    "extension_pages": "script-src 'self'; object-src 'self'"
  }
}

How to fix

Use the browser default: script-src 'self'; object-src 'self'.
If the extension must evaluate generated code, bundle an interpreter instead of permitting string-to-code.
If it needs third-party scripts, list each host in script-src (for example https://cdn.example.com/).
When auditing a third-party extension, treat an unsafe-eval CSP as a remote-code-load primitive.

What Vulkro detects​

Non-compliant code​

Compliant code​

How to fix​

References​

What Vulkro detects

Non-compliant code

Compliant code

How to fix

References