Script sources are safe (no wildcards)
Why it matters
CWE-79 (Cross-Site Scripting) in an extension context is substantially more dangerous than on a website: extension pages run with privileged access to chrome.* APIs, so an XSS that executes in an extension page can read storage, make API requests, or exfiltrate data from all tabs the extension accesses. CWE-693 (Protection Mechanism Failure) names the category. In Manifest V3, remote code execution is outright banned by Chrome policy; any script-src directive permitting remote URLs will cause CWS rejection. Wildcards in script-src (e.g., https:) completely defeat CSP. The Chrome MV3 CSP documentation makes this a hard requirement, not a recommendation.
Severity rationale
Critical because a permissive `script-src` in an extension page allows script injection into a privileged context with direct access to Chrome APIs, turning any XSS into full extension compromise.
Remediation
Set script-src to 'self' only in manifest.json CSP. Bundle all libraries locally — do not load scripts from CDNs. In MV3, any remote script source is a CWS policy violation.
"content_security_policy": {
"extension_pages": "script-src 'self'; object-src 'none'"
}
If you need WebAssembly, add 'wasm-unsafe-eval' only — not the broader 'unsafe-eval'.
DetectionPro
The detection method for this pattern is part of AuditBuffet Pro.
The full method (what to look for, pass and fail conditions, and how results get reported) ships inside the Extension Permissions & Security Audit. The pattern definition, severity rationale, and remediation remain openly licensed under CC-BY-4.0.
External references
- cwe · CWE-79 — Improper Neutralization of Input During Web Page Generation (XSS)
- cwe · CWE-693 — Protection Mechanism Failure
- owasp:2021 · A03
- external · chrome-mv3-csp — Chrome Extensions MV3: Content Security Policy
Taxons
History
- 2026-04-18·v1.0.0·Initial import from extension-permissions-security·automated