Error messages · Chrome extension

Insecure CSP value in directive 'script-src'

What you see

'content_security_policy.extension_pages': Insecure CSP value "'unsafe-eval'" in directive 'script-src'.

Why it happens

Version 3 extensions may only run code that ships inside the extension. Chrome refuses a policy whose script-src, worker-src, object-src or default-src allows 'unsafe-eval', 'unsafe-inline' or a website such as a CDN. ChatGPT often adds a CDN address so a library can load from the web.

The fix

• rightsocket does this Removes those values and keeps 'self', so the manifest loads. If script-src is missing, it adds script-src 'self'.
• You do this Download the library (the .js file at the CDN address) into the extension folder and load it from there. Code that uses eval or new Function needs rewriting: ask ChatGPT for a version without eval.

What changed, and when

• 24 July 2025, Chrome: Chrome 138: Manifest V2 extensions disabled for all users on all channels, with no option to turn them back on. Chrome 139 then removed the enterprise policy that kept them working.

Sources

• Chromium source: version 3 policies can’t allow remote code (csp_validator.cc)
• Chrome for Developers: content_security_policy in the manifest
• Stack Overflow: "Insecure CSP value "'unsafe-eval'" in directive 'script-src'"

Other chrome extension errors

• Manifest version 2 is deprecated
• Service worker registration failed. Status code: 15
• Manifest is not valid JSON
• Could not load icon specified in the manifest
• Refused to execute inline script (Content Security Policy)
• chrome.browserAction is undefined (Manifest V3)
• 'browser_action' requires manifest version of 2 or lower
• 'webRequestBlocking' requires manifest version of 2 or lower
• Permission is unknown or URL pattern is malformed
• Invalid value for 'web_accessible_resources[0]'
• Invalid value for 'content_security_policy'