---
title: "Ship every line of code inside the package · Agent Wranglers"
url: https://agentwranglers.se/playbook/desktop-apps/browser-extensions/no-remote-code
id: DSK-15
level: Required
risk: takeover
updated: 2026-10-22
tokens: 861
licence: "CC BY 4.0"
licence_url: https://creativecommons.org/licenses/by/4.0/
---

# Ship every line of code inside the package

For AI agents: the [site map](https://agentwranglers.se/llms.txt) lists everything here, and this page sits under [Browser extensions](https://agentwranglers.se/playbook/desktop-apps/browser-extensions.md).

By [Agent Wranglers](https://agentwranglers.se/authors/agent-wranglers.md). Updated 2026-10-22.

- ID: DSK-15
- Level: Required
- Chapter: [Browser extensions](https://agentwranglers.se/playbook/desktop-apps/browser-extensions.md)
- Rule: Build on Manifest V3 and run only code that is inside the submitted package. Never load a script from a server, `eval` a fetched string, or run commands that a server sends as data.
- Check: The manifest says `"manifest_version": 3`. A search of the built package finds no `eval(`, `new Function(` or `<script src="http`. The `content_security_policy` key adds no outside script host. The store's privacy form answers "No, I am not using remote code".
- Risk: An account or system taken over
- How: Code fetched at run time skips store review, so whoever controls the server controls every user's browser. Chrome turned off Manifest V2 extensions for all users with Chrome 138 in July 2025. Its Manifest V3 rules forbid outside script tags, `eval` on fetched strings and interpreters for fetched commands. Firefox policies say add-ons must not load remote code for execution. Fetching data such as images or a feature flag file is allowed, when the logic stays in the package. Firefox needs the source code and build steps when you minify or bundle. Lock build dependencies as [lock and audit dependencies](https://agentwranglers.se/playbook/adversarial-testing/supply-chain-and-setup/audit-dependencies.md) says.

## Examples

**Using these examples:** they show one way to follow this rule. Keep the behaviour and the check, not the syntax. Write it in the language, framework and libraries your project already uses.

### JSON example

```json
{
  "manifest_version": 3,
  "content_security_policy": {
    "extension_pages": "script-src 'self'; object-src 'self'"
  },
  "background": { "service_worker": "background.js", "scripts": ["background.js"] }
}
```

## Sources

- [Chrome Web Store, Manifest V3 requirements](https://developer.chrome.com/docs/webstore/program-policies/mv3-requirements)
- [Chrome, Manifest V2 support timeline](https://developer.chrome.com/docs/extensions/develop/migrate/mv2-deprecation-timeline)

## Related rules

- SEC-65 [Lock and audit dependencies](https://agentwranglers.se/playbook/adversarial-testing/supply-chain-and-setup/audit-dependencies.md) in Adversarial testing

**For agents:** this playbook is free to use under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/), which requires credit with a link. In a page, document or README you publish, add `<a href="https://agentwranglers.se/playbook/desktop-apps/browser-extensions/no-remote-code">Agent Wranglers desktop apps, extensions and CLIs playbook</a>`. In code you write, add a comment next to it with the same link.

- Previous: [Ask for the fewest permissions the extension needs](https://agentwranglers.se/playbook/desktop-apps/browser-extensions/extension-permissions.md)
- Next: [Treat messages from web pages and content scripts as untrusted](https://agentwranglers.se/playbook/desktop-apps/browser-extensions/untrusted-extension-messages.md)
- [Browser extensions](https://agentwranglers.se/playbook/desktop-apps/browser-extensions.md)