No unsafe-eval

CWE-95 (Eval Injection) and CWE-79 both apply here: 'unsafe-eval' in an extension CSP enables eval(), new Function(), and setTimeout with string arguments, all of which can execute attacker-controlled strings as code. In an extension context, that code runs with chrome.* API access. OWASP A03 (Injection) covers this attack class. Chrome's own documentation states that 'unsafe-eval' should never appear in extension CSP; MV3 bans it entirely. Even in MV2, its presence typically indicates AI-generated or copy-pasted code that hasn't been refactored for the privilege model extensions require.

Remove 'unsafe-eval' from CSP and refactor every eval() and new Function() call to use static alternatives.

"content_security_policy": {
  "extension_pages": "script-src 'self'; object-src 'none'"
}

For template rendering without eval, use document.createElement + .textContent rather than string-interpolated HTML. If a devtool panel needs to evaluate arbitrary user code, use a sandboxed iframe page — Chrome allows 'unsafe-eval' in sandboxed pages specifically.