No unauthorized external script injection occurs

An extension that injects external scripts into web pages becomes a forced intermediary between the user and every site they visit. The injected script runs with the page's origin permissions and can read DOM content, capture form data, and exfiltrate it to any server the injected script chooses — entirely outside the extension's declared permissions. CWE-94 (Code Injection) and OWASP 2021 A03 describe this attack class. Chrome Web Store policy prohibits executing remote code, and Manifest V3 enforces this mechanically — but content scripts that dynamically create <script> tags pointing to external domains achieve the same effect and are a common policy violation. Any injected external script is a persistent supply chain risk: if that third party is compromised, every user of your extension is compromised.

Remove all dynamic external script injection from content scripts. Bundle dependencies locally and use fetch-based API calls for external data:

// BAD — injects external script into every page
const s = document.createElement('script');
s.src = 'https://cdn.example.com/tracker.js';
document.head.appendChild(s);

// GOOD — bundle locally or use fetch
import { feature } from './local-bundle.js';

// For external data, use the extension's background service worker
chrome.runtime.sendMessage({ type: 'FETCH_DATA' }, (response) => {
  // Use response.data in content script
});

For Manifest V3, the content_security_policy in manifest.json can enforce this at the browser level — set "script-src 'self'" to block injection from external origins entirely.