Using Chrome Extension Manifest V3, How Do I Execute Code Strings?

Question

I’m writing a Chrome extension using Manifest V3 and trying to find a way to execute code strings dynamically (similar to userscripts). There are methods to execute code strings (eval, setTimeout, new Function, etc.); however, they seem forbidden in Manifest V3. While setTimeout still works, the Chrome team states that executing code strings will no longer be accepted when submitted to the Chrome Web Store. The code needs to be part of the extension when submitted. Also stated in the link below under “Remotely Hosted Code”:

https://developer.chrome.com/docs/extensions/mv3/intro/mv3-migration/

Saw some forum posts and crbugs posted about this issue, but they all seem outdated without a definitive answer. Like the link above, older posts state that it will no longer be possible to execute code strings. Newer but still outdated (2020) posts state that Manifest V3 will have use cases (such as TamperMonkey) where userscripts can be registered dynamically but only after giving the user a prompt. The only two methods I see that let an extension run scripts dynamically are “chrome.scripting.registerContentScripts” and “chrome.scripting.executeScript”. Both methods execute code from files, not strings. The older method “chrome.tabs.executeScript” used to allow executing code strings but is now deprecated.

Is there a way that is allowed by the Chrome Web Store or any update to this issue?

Edit 1:

If executing scripts dynamically from files is the only way:

1. Do Chrome Extensions allow saving files in the extension directory? Or would it invalidate the extension (the extension is automatically uninstalled because of some security policy)?
2. If the extension is allowed to save files outside of the extension directory, can the two current methods (mentioned above) execute those files?

Edit 2:

Reworded 2 (under Edit 1).

Edit 3:

Thanks to all that have replied. Doesn’t seem like there is a solution to this issue, yet. There have been no public announcements that I have heard or read about as to how (if it’s possible) script code strings can be dynamically executed (that would not be rejected by the Chrome Web Store).

As of November 13, 2021, you can do one of the following:

• Depending on your use case, take the advice from @wOxxOm or @hashed tomato.
• Downgrade to Manifest V2 and use “chrome.tabs.executeScript”. This is only a temporary fix as Manifest V2 will cease to work after a specified time.
• Not sure if this will be rejected when submitting the extension to the CWS. Allow the user to save scripts via the extension. As of the time I’m writing this, I don’t know of a way to save the files that will enable the saved files to be executed by one of the other two methods “chrome.scripting.registerContentScripts” and “chrome.scripting.executeScript”. Testing needs to be done, otherwise, I would state it here.

Thanks everyone.

Durga

crbug.com/1239976 – Messenia

@wOxxOm think I can finally add a comment because of my reputation, otherwise, I would have replied earlier. Didn’t want to leave a reply to you as an answer to my own question. Thanks for the link. Tempted to do it, however, it looks like the Chrome Team stated that would only be allowed for unpacked extensions. My submission to the Chrome Web Store would probably be rejected. Thanks for trying to help though. – Durga

Latest: github.com/w3c/webextensions/issues/279#issuecomment-1255843961 – Courier

Answer 1

In sandbox, code string can be executed.

https://developer.chrome.com/docs/extensions/mv3/manifest/sandbox/

There is several restrictions to the sandbox code, for example, it cannot access to DOM. It depends on what you want to do by the code string.

Andro

thanks for the reply and the link. I have already tried the sandbox. Think it may not have worked because the content is an external webpage. Thanks again for trying to help. – Durga

will this method make userscript managers like Tampermonkey work in Manifest v3? – Cnemis