EG-RHC-001: Remote executable script reference

What ExtensionGate detects

The rule parses packaged HTML and manifest-declared extension pages for script sources that resolve to an http: or https: URL. It reports the file and bounded evidence location.

It does not fetch the URL. Package analysis is local, and nested archives are not recursively expanded.

Why it may matter

Chrome defines remote hosted code as executable JavaScript or WebAssembly loaded outside the submitted package. Manifest V3 requires executable extension logic to remain reviewable in the package.

Microsoft's Edge policies also require a reviewable, secure, and fully testable extension. Store reviewers remain the authority for each submission.

Synthetic failing example

<script src="https://cdn.example.test/widget.js"></script>

The browser would load executable JavaScript from outside the reviewed ZIP. The host is synthetic and is never contacted by the scanner.

Passing or legitimate example

<script src="/vendor/widget.js"></script>
<script type="module" src="./app.js"></script>

Both paths resolve inside the synthetic package. Bundling does not itself prove the code is safe, licensed, or policy-compliant.

Remediation

1. Identify who owns the remote script and what executable behavior it supplies.
2. Pin and bundle the required executable code into the extension build.
3. Replace remotely changeable logic with a constrained data format interpreted by packaged code where appropriate.
4. Search the final ZIP, test with the network unavailable, and document legitimate remote-data endpoints for reviewers.

False-positive boundaries

• Ordinary links, images, stylesheets, and JSON endpoints are not reported by this HTML script-source rule.
• A packaged script path that redirects only at an external web server is outside this rule because extension-package paths are local.
• A literal URL in documentation or a comment is not enough to trigger this specific parser-backed check.

What static analysis cannot determine

• Fetched text may be executed indirectly by eval-like code that another rule must detect.
• A remote response's real media type and content cannot be known without network access.
• Runtime-generated URLs and backend behavior may be invisible to a package-only scan.

Official sources

• Chrome: deal with remote hosted code violations
• Chrome: what is Manifest V3?
• Microsoft Edge extension developer policies

Rule version history

Related guides

• Fix Manifest V3 remote hosted code
• Chrome readiness