What the policy controls
CSP applies to extension pages and, when configured, sandboxed pages. It restricts script sources, object sources and other resource loads. Manifest V3 enforces stricter defaults than older extensions.
The manifest field can be a string in V2 or an object in V3. The viewer extracts extension_pages, sandbox and related entries so you can read the effective rules.
Related pages:manifest viewerManifest V3 permissions
Values that deserve attention
script-src 'self' is the normal restrictive baseline. The addition of 'unsafe-eval' permits string-to-code execution such as eval or new Function. 'unsafe-inline' permits inline scripts. Remote script hosts in script-src can allow external code, depending on manifest version and browser rules.
A permissive CSP is not automatically malicious. Some libraries or legacy features require it. It does increase the impact of an injection flaw and should be explained.
| Value | Meaning | Review note |
|---|---|---|
| 'self' | Only packaged extension scripts | Restrictive baseline |
| 'unsafe-eval' | Allows string-to-code execution | High-impact relaxation |
| 'unsafe-inline' | Allows inline scripts | Weakens injection protection |
| https://cdn.example | Allows scripts from a host | Remote code risk |
| sandbox | Isolates a page | Limits access to extension APIs |
Related pages:remote script detectormanifest V2 vs V3
CSP is one layer
A restrictive CSP does not fix excessive permissions or unsafe data handling. A permissive CSP does not prove that an extension misbehaves. Read the policy alongside the manifest permissions and code findings.