Securing Browser Extensions: Content Security Policy & Isolation in Manifest V3

Browser extensions operate with elevated privileges, often possessing permissions to inspect cookies, intercept network traffic, and manipulate web page DOMs. Consequently, extensions are prime targets for supply chain attacks where malicious npm dependencies attempt to exfiltrate session credentials.

Manifest V3 strictly forbids executing strings as code. The use of `eval()`, `new Function()`, and injecting external script tags (`<script src="https://cdn.example.com/lib.js">`) will result in immediate rejection by the Chrome Web Store automated audit scanners. All executable code must be bundled locally within the extension zip package.

In `manifest.json`, defining an airtight Content Security Policy guarantees that even if a dependency is compromised, it cannot phone home to unauthorized servers:

{
  "content_security_policy": {
    "extension_pages": "script-src 'self'; object-src 'none'; connect-src 'self' https://api.openai.com https://generativelanguage.googleapis.com;"
  }
}