Fix Manifest V3 remote hosted code

Outcome: A self-contained MV3 execution path
Store lens: Chrome Web Store
Reading time: 9 minutes

Scope:Static evidence can find common loading patterns but cannot prove every runtime path or whether a remote payload is executable.

What Chrome means by remote hosted code

Chrome defines remote hosted code as executable JavaScript or WebAssembly loaded from outside the submitted extension package. Manifest V3 expects the extension's logic to be reviewable in the package.

Ordinary remote data such as JSON, images, and CSS is not automatically remote hosted code. The decisive question is whether the fetched material is executed as logic.

Find the execution boundary

Search manifest files, HTML, JavaScript, and generated bundles for remote script tags, dynamic imports of HTTP URLs, eval-like execution of fetched text, WebAssembly streaming, and libraries that download executable modules.

Trace each hit through the build. A source file may look safe while a plugin injects a remote loader into the final package.

Synthetic example

                <!-- Synthetic failing example -->
<script src="https://cdn.example.test/widget.js"></script>

// Also suspect: fetched text executed as code
const body = await fetch(config.moduleUrl).then(r => r.text());
new Function(body)();

Bundle code without freezing data

Install the dependency at build time, bundle the executable files, and reference only packaged paths at runtime. If configuration must change remotely, fetch a constrained data schema and interpret it with packaged logic.

Pin dependencies and preserve license notices. Test the packaged output with the network blocked so the primary local execution path is visible.

Synthetic example

                // Synthetic legitimate remote-data pattern
const response = await fetch("https://api.example.test/config");
const config = await response.json();
applyPackagedTheme({ color: config.allowedColor });

Document and retest

Explain remote endpoints and remote-data purpose in reviewer notes. Rescan the exact ZIP, search minified output, then run functionality and security tests.

Chrome associates the Blue Argon violation with suspected remote hosted code. Treat the code as a pointer to official remediation, not as a complete diagnosis of your package.

Official sources

Sources and guidance were human-reviewed on 2026-07-29. Store forms and policies can change; verify them again at submission time.

Related ExtensionGate pages

Run a private preflight All guides