Blue Argon is the notification ID Google attaches to the Additional requirements for Manifest V3 violation. The stated intent is to ensure Manifest V3 extensions are not including remotely hosted code. Google lists three common reasons:
- Including a
<script>tag that points to a resource that is not within the extension's package. - Using JavaScript's
eval()method or other mechanisms to execute a string fetched from a remote source. - Building an interpreter to run complex commands fetched from a remote source — even if those commands are fetched as data.
The line to remember: remote data is fine; remote logic is not. Talking to your API is allowed. The violation is remote resources that contain executable logic — a response that merely configures features your package already ships is a different (and generally acceptable) thing.
Quick self-check
grep -rn "src=\"http" src/ # remote script tags
grep -rn "eval(" src/ # eval on anything fetched?
grep -rn "new Function" src/ # string-to-code paths
A common accidental trigger is a hosted analytics snippet someone added months ago. The fix is usually to bundle the dependency into the package instead of loading it from a CDN.
Full fix guide: What counts as remote code — what actually counts, what doesn't, and how to bundle a CDN dependency before you resubmit.
Or paste your rejection email into the free rejection decoder to see the common violation IDs explained. Not sure what to change? The free triage form gets you our reading — not a ruling from Google, and nobody can guarantee approval.
See also: the full rejection ID reference · Purple Potassium (excessive permissions) · Why Chrome Web Store rejects extensions