Execution of external logic with CDP in Manifest V3

304 views
Skip to first unread message

Vadym Avdieiev

unread,
Apr 8, 2024, 2:12:21 PMApr 8
to Chromium Extensions
Hello,

In Manifest V3 we can no longer execute external logic using `executeScript()`, `eval`, and `new Function()`. Documentation does not mention it, so I wonder if this restriction applies to code executed using Chrome DevTools Protocol (with debugger attached), for example with Runtime.evaluate command, as well? It does work, that is, the code is executed, but I'm not sure it will pass Chrome Web Store review.

Some context: I'm working on a Chrome extension for automated testing. It records user activity on a website to be played back automatically on arbitrary schedule. Users can provide custom javascript to be executed during playback. I'm in the process of migrating this extension to Manifest V3, so I'd like to know if using CDP to execute user-provided code would be allowed by Chrome Web Store policy.

Thank you!

Patrick Kettner

unread,
Apr 9, 2024, 7:28:35 PMApr 9
to Vadym Avdieiev, Chromium Extensions
Hi Vadym,
This is supported, and is documented in Additional Requirements for Manifest V3. Specifically, the debugger api portion. 

--
You received this message because you are subscribed to the Google Groups "Chromium Extensions" group.
To unsubscribe from this group and stop receiving emails from it, send an email to chromium-extens...@chromium.org.
To view this discussion on the web visit https://groups.google.com/a/chromium.org/d/msgid/chromium-extensions/59e2f4e0-7112-4610-8e86-3b78efdfec70n%40chromium.org.

Joe Floe

unread,
May 8, 2024, 7:34:20 AMMay 8
to Chromium Extensions, Patrick Kettner, Chromium Extensions, Vadym Avdieiev
Hi Patrick,
I have one related question to clarify.
Is it allowed by policies to use eval() inside code injected to a page with debugger api  in MV3 (for example with Runtime.evaluate command)? The eval() is supposed to evaluate 3rd party code in my case.

Oliver Dunk

unread,
May 8, 2024, 7:40:37 AMMay 8
to Joe Floe, Chromium Extensions, Patrick Kettner, Vadym Avdieiev
Hi Joe,

That's fine too.

We're keen to see less usage of eval of course - but we're aware that there are cases where evaluating third-party code is required, such as automated testing tools, and we had those in mind when we updated the policy recently.

Thanks,
Oliver Dunk | DevRel, Chrome Extensions | https://developer.chrome.com/ | London, GB


Reply all
Reply to author
Forward
0 new messages