The fix, in one snippet
eval(…), new Function(…), or a <script src> pointing off-extensionIllustrative values. Change the paths, hostnames and options to match your own site before using it.
The sections below explain what is tested, why it matters and the alternatives.
What we test
The analyser statically scans every JavaScript and HTML file in the package for: eval(), new Function(), setTimeout or setInterval with a string argument, <script src> pointing off-package in extension pages, importScripts() with a remote URL in the service worker, fetch() or XMLHttpRequest responses passed to eval, Function or (Manifest V2) tabs.executeScript({code}), and Manifest V2 policies that add remote hosts to script-src. A remote configuration file that decides where scripts are injected is reported as information, since it is data rather than code. Fetch-then-execute is critical. Limits: obfuscation can hide the pattern; nothing is run. The Chrome Web Store prohibits remotely hosted code in Manifest V3, so an MV3 extension that does this is either non-compliant or sideloaded.
Why it matters
A store review examines a fixed version. Remote code lets the developer, or whoever later buys the extension or takes over its server, change behaviour for every user at once, with no update and no review: inject affiliate links, harvest cookies, mine cryptocurrency. The classic failure is an abandoned extension whose script host domain expires; whoever registers it next runs code in every remaining install. Users of the extension and any network they work on are affected.
How to fix it
Users: remove the extension. If you depend on it, look for a Manifest V3 alternative from the official store; Firefox's AMO review also bans remote code. Enterprises can restrict installs with the ExtensionInstallAllowlist policy.
Developers: bundle every script in the package and ship configuration as data, not code. Manifest V3's CSP blocks remote scripts in extension pages, but a content script can still fetch a string and inject it into the page, so audit content scripts too.
// bad: fetched string executed
fetch(url).then(r => r.text()).then(src => eval(src));
// good: packaged file
chrome.scripting.executeScript({target: {tabId}, files: ["inject.js"]});Related checks: obfuscated code and weakened CSP. Guide: are browser extensions safe?
Where this fits
Extension loads or evaluates remote code is check 1 of 9 that the browser extension analyzer runs under extension permissions and behaviour, ordered the way they are worth fixing. That ordering is the point: Fixing this one while the check above it still fails buys less than it looks like.
What fixing this still leaves open
Extension loads or evaluates remote code closes one route in. Immediately below it: Extension can read and change data on all websites, where the extension asks for access to every website, so it can read and change everything you see and type in the browser; Extension code is obfuscated, where the extension's JavaScript is obfuscated rather than merely minified, which hides its behaviour from reviewers and breaks the Chrome Web Store's code-readability rule; Extension requests high-risk permissions, where the extension requests permissions that reach beyond the page: Intercepting requests, reading cookies or history, controlling downloads, talking to native programs, or debugging other tabs.
The first few lines
You are a senior web engineer. I ran a security and SEO scanner against my site and it reported the finding below. Fix it properly rather than suppressing the symptom.
Finding: Extension loads or evaluates remote code (critical severity)
Scanner check id: extension-remote-codeThe rest of this prompt names the pages and line numbers we found the problem on, the configuration to change, and the constraints a good answer has to respect. It is free, it just needs an account so the work is not scraped wholesale.
Sign in with GoogleSigning in is free and takes one click. We store your email address and nothing else.
