The fix, in one snippet
"content_security_policy": { "extension_pages": "script-src 'self'; object-src 'none'" }Illustrative values. Change the paths, hostnames and options to match your own site before using it.
The sections below explain what is tested, why it matters and the alternatives.
What we test
The analyser reads content_security_policy: a string in Manifest V2, an object with extension_pages and sandbox keys in Manifest V3. It flags 'unsafe-eval' in extension pages (forbidden in MV3; 'wasm-unsafe-eval' is allowed), 'unsafe-inline' for scripts (ignored by browsers but a sign of intent), any remote host in script-src or object-src (MV2 permitted specific HTTPS hosts; MV3 permits none), a missing object-src 'self', and a sandbox policy that admits remote scripts. The offending directive is quoted. Limits: browsers enforce a minimum policy and refuse to load an MV3 extension with an invalid one, so a weak CSP in a store-installed extension usually means it is MV2; sideloaded packages are checked less strictly.
Why it matters
The popup, options and background pages run with the extension's full permissions. The default policy, script-src 'self'; object-src 'self', means only packaged code can run there. If the developer adds 'unsafe-eval' or a remote host, any injection into those pages, for example rendering a tab title or a fetched string with innerHTML, becomes code that runs with the extension's cookie, tab and host access. That is cross-site scripting at extension privilege, and it is the reason Manifest V3 removed the ability to relax the policy.
How to fix it
Users: prefer Manifest V3 extensions, whose policy cannot be weakened. If an MV2 extension whitelists remote script hosts, weigh whether you need it.
Developers: omit the content_security_policy key unless you need a sandbox. Never add 'unsafe-eval' to extension_pages; put libraries that require it in a sandboxed page and communicate with postMessage. Use textContent rather than innerHTML for untrusted strings.
"content_security_policy": {
"extension_pages": "script-src 'self'; object-src 'self'",
"sandbox": "sandbox allow-scripts; script-src 'self' 'unsafe-eval'"
}Related: remote code and, for websites, the CSP check. Guides: the practical CSP guide and are browser extensions safe?
Where this fits
Extension weakens its Content-Security-Policy is check 7 of 9 that the browser extension analyzer runs under extension permissions and behaviour, ordered the way they are worth fixing. That ordering is the point: Fixing this one while the check above it still fails buys less than it looks like.
Fix this one first
Above it in the same category sits Extension contacts external endpoints (medium), where the extension's code contains addresses of external servers it communicates with, so some of your data or activity may leave the browser. An attacker who has that does not need this, so it is the better use of the same hour.
What fixing this still leaves open
Extension weakens its Content-Security-Policy closes one route in. Immediately below it: Extension uses Manifest V2, where the extension still declares manifest_version 2, a format Chrome no longer runs and that lacks the stricter code and policy rules of Manifest V3; Extension declares optional permissions, where the extension declares optional permissions or optional host permissions that it can request later at runtime.
The first few lines
You are a senior web engineer. I ran a security and SEO scanner against my site and it reported the finding below. Fix it properly rather than suppressing the symptom.
Finding: Extension weakens its Content-Security-Policy (medium severity)
Scanner check id: extension-weak-cspThe rest of this prompt names the pages and line numbers we found the problem on, the configuration to change, and the constraints a good answer has to respect. It is free, it just needs an account so the work is not scraped wholesale.
Sign in with GoogleSigning in is free and takes one click. We store your email address and nothing else.
References
Related guides
9 min read · Updated Sep 16, 2026
Content Security Policy (CSP): A Practical Guide to Writing One That Works
A Content Security Policy tells the browser which scripts, styles and resources a page may load, which defeats most cross-site...
Read the guide
7 min read · Updated Sep 10, 2026
Are Browser Extensions Safe? How to Audit What You Have Installed
Extensions run with more access than any website, and a sold or hijacked extension can read everything you do. What each permission...
Read the guide