[vbezhenar]

I don't think that's what I'm talking about. I'm talking about inserting a script from the extension which will then download another script from the external source and execute it. Once you've got access to the DOM, you're pretty much unstoppable.

[oefrha]

No, CSP doesn’t allow you to download scripts from an external source. That’s the point of the CSP.

[mh-]

Since one of the parent comments mentioned AJAX, I'll add that you'll also be prevented from eval'ing that payload.

[oefrha]

Yes, I should have been more clear: CSP doesn’t allow you to download an external script and execute it, which requires unsafe-eval.

[TeMPOraL]

Sounds like your exception will need to become a language interpreter itself.

[TOMDM]

Does manifest v3 support wasm?

Time to package a JavaScript interpreter into wasm and run it within the extension.

[vbezhenar]

You still can just write your userscript as an extension. I just checked - it works. I inserted script into HN and did some stuff.

[oefrha]

I never said you can’t.

[vbezhenar]

Can you pass data between script and extension? Implementing JS or lua should be possible.

[horsawlarway]

Yes - I have done this in an MV3 extension. You can basically re-implement your own runtime and download the code and run it there instead of using eval/script tags.

It's very inefficient and it's a pain to write, but it is possible.

I suspect they will not approve extensions that do this if it becomes popular.