hmm, they don't mention `eval()` being blocked in executed functions. Is it mentioned elsewhere?
Also, can't executed function just add `<script>` tag with given `src`?
Also, can't executed function just add `<script>` tag with given `src`?
> In addition, MV3 disallows certain CSP modifications for extension_pages that were permitted in MV2. The script-src, object-src, and worker-src directives may only have the following values: self; none; Any localhost source, (http://localhost, http://127.0.0.1, or any port on those domains)
In other words, scripts with access to the extension APIs are no longer allowed to specify the "unsafe-eval" CSP, and so they can no longer call eval().
[1]: https://docs.google.com/document/d/1nPu6Wy4LWR66EFLeYInl3Nzz...
[2]: https://developer.chrome.com/docs/extensions/mv3/intro/mv3-m...