I think the article is talking specifically about downloading and running scripts for working around a particular site dynamically, such as Youtube ad blockers.
That said, I don't know if this really is a technical block from e.g. adding a script tag to a YouTube page to pull in a third party resource. My impression was that it was blocking arbitrary scripts specifically within the extension context, and not in the browser context.
The article specifically mentions "filter lists" being subject to review time.
> All updates, even to benign things like a filtering list, will need to happen through full extension updates through the Chrome Web Store.
> Is a filtering list update, which is essentially just a list of websites, really something that needs to be limited by the "no remotely hosted code" policy?
> So since all filter list updates now need to go through the Chrome Web Store, how long does a review take?
Chrome explicitly recommends downloading remote configuration.
To me, this seems pretty clear: don't inject anything "executable" into a webpage except CSS.
It does look like you could maybe use a sandboxed iframe and ask it about page features and whether they should be blocked, and that this might be permitted.
CSS has arithmetic. It does not have iteration.
And even if it had full compute capabilities, the output is still just choosing CSS rules to apply.
Edit - would it be considered cheating to use: <meta http-equiv="refresh" content="10">