ExtGuard
Blue ArgonCode QualityHard rejection

Manifest V3 — remote code execution

Manifest V3 extensions must not load or execute remotely-hosted code.

Common reasons Google rejected this

  • 01A <script> tag points to a URL outside the extension package.
  • 02JavaScript eval() is used to execute strings fetched from a remote source.
  • 03The extension fetches code as data and runs it through an interpreter.

How to fix it

  • Replace external script references with local files bundled in the zip.
  • Remove eval(), new Function(), and string-form setTimeout()/setInterval().
  • Move dynamic configuration to JSON files and parse with JSON.parse — never execute.

ExtGuard scans for this automatically

Our scanner runs 4 checks that catch this violation before submission.

Read Google's full policy

developer.chrome.com

Don't risk another rejection

Run all 25 ExtGuard checks against your zip in 3 seconds.