Chrome and Firefox both prohibit extensions from executing logic fetched from a remote server. The reviewed package is supposed to contain everything that runs. This makes review meaningful, because what reviewers see is what runs. It does not stop a malicious update that ships bad code inside the package.
What Chrome says
For Manifest V3, Chrome's documentation states that all of an extension's logic must be part of the extension package. Remote JavaScript, including code from a CDN, is not allowed under Chrome Web Store policy. The store's program policies repeat this: extensions generally cannot run logic fetched from a remote source, with exceptions for the Debugger API and the User Scripts API.
Loading external data is permitted, but the data cannot contain logic. Obfuscation is prohibited. Minification is allowed.
What Firefox says
Mozilla's add-on policies say add-ons must be self-contained and must not load remote code for execution. They also ban obfuscated code and code that hides its purpose, while allowing minification to reduce file size. Mozilla reviews code before transpiling or minification, so authors have to provide it in a reviewable way.
What it allows instead
Chrome lists alternatives for developers: load remote configuration, call a remote web service, bundle libraries locally, or use sandboxed iframes. In sandboxed iframes, eval and new Function remain supported. In ordinary extension contexts, executeScript, eval and new Function cannot run external logic.
Why the rule exists
Before this approach, an extension could pass review and then download different behavior later. Reviewers could not see it, and neither could users. Requiring logic to ship in the package means each version is a fixed artifact that can be inspected, compared and blocked.
What it does not solve
Be realistic about the limits.
- A publisher can ship a malicious version. The rule makes this reviewable, not impossible.
- Remote configuration can still change behavior within what the code already supports, for example which domains to target.
- A publisher account takeover can push a new package. Review catches some of these, not all.
- Data collection is a separate matter, governed by the limited use rules.
So the rule shifts risk, it does not remove it. Permissions and site access still matter. See how the Chrome Web Store single purpose rule helps users.
What users and teams can do
- Prefer extensions with a narrow purpose and narrow permissions.
- Review permission changes in updates instead of clicking through.
- For teams, use an allowlist so new extensions need approval. See how to block Chrome extensions company wide.
Quick check
Can an extension still fetch data from a server?
Yes. Both browsers allow external data. The rule is about executing logic, not about network access.
Is minified code allowed?
Yes, in both stores. Obfuscation is what is prohibited.
Sources
- Improve extension security, Manifest V3 (Chrome for Developers)
- Chrome Web Store program policies
- Add-on policies (Extension Workshop)
Last reviewed: 19 October 2026.
