Manifest V3 — remote code execution

Common reasons Google rejected this

• 01A <script> tag points to a URL outside the extension package.
• 02JavaScript eval() is used to execute strings fetched from a remote source.
• 03The extension fetches code as data and runs it through an interpreter.

How to fix it

• Replace external script references with local files bundled in the zip.
• Remove eval(), new Function(), and string-form setTimeout()/setInterval().
• Move dynamic configuration to JSON files and parse with JSON.parse — never execute.

ExtGuard scans for this automatically

Our scanner runs 4 checks that catch this violation before submission.