Content Security Policy excludes unsafe-eval

unsafe-eval in a Chrome extension's Content Security Policy permits dynamic code execution via eval(), new Function(), and related patterns — exactly the primitives an attacker uses in an XSS payload. Chrome Web Store (chrome-cws-csp-policy) blocks extensions with unsafe-eval in their CSP outright; there is no exception process. Beyond store rejection, allowing eval() in an extension context means any cross-site scripting vulnerability in the extension's pages can escalate to full browser API access, violating OWASP A03 (Injection) and CWE-95 (Improper Neutralization of Directives in Eval).

Remove unsafe-eval, unsafe-inline, and unsafe-hashes from your manifest's CSP. The default restrictive policy applies if you omit the field entirely.

{
  "content_security_policy": {
    "extension_pages": "script-src 'self'; object-src 'self';"
  }
}

If you currently use eval() for dynamic logic, refactor to static code or use chrome.scripting.executeScript with a declared function reference. Bundlers like esbuild and Webpack compile templates to static JS at build time, eliminating any need for runtime eval().