Unreject

Blue Argon Google section: Additional requirements for Manifest V3

Blue Argon: Remotely hosted code (Manifest V3)

Manifest V3 items must ship all executable code inside the package. Something in yours loads JavaScript from a server or executes a string, and the reviewer counts that as remote code.

The fix: rejected → fixed

popup.html− rejected+ fixed
<head>  <link rel="stylesheet" href="popup.css">  <script src="https://cdn.jsdelivr.net/npm/chart.js"></script>  <script async src="https://www.googletagmanager.com/gtag/js?id=G-XXXX"></script>  <script src="vendor/chart.umd.min.js"></script>  <!-- analytics: GA4 Measurement Protocol via fetch() in background.js -->  <script src="popup.js" defer></script></head>

Chart.js now ships inside the package under vendor/. Analytics events go to the GA4 Measurement Protocol with fetch(), which sends data and loads no code.

Why you got Blue Argon

  • A <script src="https://cdn…"> tag in popup.html or options.html (jQuery, Chart.js, Bootstrap JS, etc.).
  • Google Analytics (gtag.js), Firebase or another SDK loaded from its CDN.
  • eval(), new Function() or setTimeout("string"), especially on text fetched from your API.
  • Fetching a script and passing it to chrome.scripting.executeScript or injecting a <script> element into the page.
  • A bundler setting that lazy-loads chunks from a public URL (publicPath pointing to a CDN).

Pre-resubmit checklist

Your ticks are saved in this browser.

Common mistake: Minified vendor code can still contain new Function (older Lodash templates, some template engines). Search the bundled output as well as your source.

Appeal or resubmission note

Replace the [BRACKETS], then use the appeal link in your rejection email. Keep it short and factual, and list only changes you actually made.

Hello Chrome Web Store team,

My item [EXTENSION NAME] (ID: [ITEM ID]) was rejected with reference Blue Argon.

I have reviewed the policy and made the following changes in version [NEW VERSION]:
- Bundled [LIBRARY] locally instead of loading it from [CDN].
- Removed all eval()/new Function() usage.
- Replaced the gtag.js snippet with server-side Measurement Protocol calls (no remote code).

[ONE SENTENCE ON WHAT THE EXTENSION DOES AND WHY IT NEEDS WHAT REMAINS.]

I have resubmitted the updated package. If anything still does not comply, I would appreciate a pointer to the specific file or listing field so I can fix it.

Thank you,
[YOUR NAME]

Google's own wording for this code is on the Chrome Web Store troubleshooting page under "Additional requirements for Manifest V3".

Other fix guides