[oefrha]

> It's still not clear to me what prevents this script to download external script using AJAX which will execute whatever user wants

If you read the MV3 migration guide you’ll quickly realize why. CSP script-src is restricted to self, none, or localhost sources for all non-sandbox pages, content scripts included.

https://developer.chrome.com/docs/extensions/mv3/mv3-migrati...

[vbezhenar]

I don't think that's what I'm talking about. I'm talking about inserting a script from the extension which will then download another script from the external source and execute it. Once you've got access to the DOM, you're pretty much unstoppable.

[oefrha]

No, CSP doesn’t allow you to download scripts from an external source. That’s the point of the CSP.

[mh-]

Since one of the parent comments mentioned AJAX, I'll add that you'll also be prevented from eval'ing that payload.

[oefrha]

Yes, I should have been more clear: CSP doesn’t allow you to download an external script and execute it, which requires unsafe-eval.

[TeMPOraL]

Sounds like your exception will need to become a language interpreter itself.

[TOMDM]

Does manifest v3 support wasm?

Time to package a JavaScript interpreter into wasm and run it within the extension.

[vbezhenar]

You still can just write your userscript as an extension. I just checked - it works. I inserted script into HN and did some stuff.

[oefrha]

I never said you can’t.

[vbezhenar]

Can you pass data between script and extension? Implementing JS or lua should be possible.

[horsawlarway]

Yes - I have done this in an MV3 extension. You can basically re-implement your own runtime and download the code and run it there instead of using eval/script tags.

It's very inefficient and it's a pain to write, but it is possible.

I suspect they will not approve extensions that do this if it becomes popular.