A vulnerability allowing Chrome extensions to execute external code, despite access rights.

Published A method that enables any Chrome extension to execute external JavaScript code without granting the extension elevated privileges (without unsafe-eval and unsafe-inline in manifest.json). Access rights imply that without unsafe-eval, the extension can only execute code that is part of its local package, but the proposed method allows bypassing this restriction and executing any JavaScript loaded from an external site within the extension's context.

Currently, Google has closed public access to the issue report, but an archived version remains as a code example for exploiting the issue. The method is similar to the method for bypassing the script-src ‘self’ restriction in CSP, which involves injecting a script tag through document.createElement(‘script’) and including external content via the fetch function, after which the code will be executed in the context of the extension itself.

Source: opennet.ru