Fix Remote Hosted Code in Manifest V3 Extensions

Distinguish executable code from remote data

Manifest V3 remote-hosted-code review is about code that the extension executes from outside the submitted package. Remote JSON, images, API responses, or CSS can still need privacy and security review, but they are not the same as a CDN script, remote dynamic import, remote worker, or fetched WebAssembly module. This distinction is why the scanner reports high-confidence loaders separately from lower-confidence remote URL review notes.

• •High risk: script tags, workers, imports, importScripts, remote WASM execution.
• •Manual review: remote URLs that may be data or configuration.
• •Safe pattern: fetch remote data, interpret it with code already bundled inside the extension.

Fix the bundle, not only the source line

A remote code finding may come from a direct line you wrote, a generated HTML file, a vendor package, or a bundler plugin. After replacing the loader or bundling the dependency locally, rebuild and scan again. Chrome Web Store evaluates the submitted package, so the absence of a remote import in source code is not enough if generated output still contains a remote executable URL.

• •Search built files for http:// and https://.
• •Replace CDN libraries with npm packages or local vendor files.
• •Check workers, worklets, sandbox pages, and generated chunks.

Common places remote executable code hides

Remote hosted code is often not a deliberate CDN script tag in a hand-written file. It can appear in generated popup HTML, a bundled analytics helper, worker-loader output, a worklet module, a WASM bootstrapper, or a stale example file copied into the release folder. The practical fix is to inspect the final package and then remove or bundle the executable dependency locally.

• •Check popup/options HTML for remote script and module tags.
• •Check workers, worklets, dynamic imports, importScripts calls, and WASM streaming loaders.
• •Check generated vendor files for URLs that are only present after bundling.

How to decide whether a remote URL is actually code

Not every remote URL is a remote hosted code violation. API endpoints, images, JSON, CSS, documentation links, telemetry URLs, and support links may be legitimate depending on the extension behavior and disclosure. The stronger signal is that the URL is loaded into a script, module, worker, worklet, WASM compiler, or dynamic execution path. That is why the scanner separates high-confidence loaders from manual-review remote URL findings.

• •Treat .js, .mjs, .cjs, and .wasm URLs as high-priority review targets.
• •Do not delete legitimate API calls just because they contain https://.
• •Document why remaining remote URLs are data or navigation rather than executable browser code.

Replacement patterns that usually age better

The durable fix is to make the extension operation understandable from the submitted package. Bundle libraries into the extension, replace CDN examples with local files, move code generation to build time, and prefer static imports over runtime script injection. For authentication or analytics SDKs, verify the package output because some wrappers load provider scripts remotely even when your source import looks local.

• •Bundle third-party code as extension-owned files.
• •Avoid runtime script tag creation for executable dependencies.
• •After replacing a dependency, rescan the ZIP rather than assuming the source change removed the built output.

Are all remote URLs forbidden?

No. Remote data, images, and API endpoints can be legitimate. The high-risk pattern is loading and executing remote JavaScript or WebAssembly as extension code.

Can I use a CDN for third-party libraries?

For extension code, bundle the library into the submitted package instead of loading it from a CDN at runtime.

What should I scan after bundling?

Scan the final production ZIP and verify that extension pages and service workers reference local bundled files.

Why scan the compiled ZIP instead of only source files?

Chrome Web Store evaluates the submitted package. Bundlers and dependencies can introduce remote script, worker, analytics, or wasm loader references that are not obvious in the source tree.