Remote Script Loading in `@amplitude/analytics-browser` Violates Chrome Extension Manifest V3 Policies
ValentinBessonov opened this issue · 5 comments
Issue Summary
The latest version of @amplitude/analytics-browser includes a reference to a remotely hosted script (https://cdn.amplitude.com/libs/visual-tagging-selector-1.0.0-alpha.js.gz). This script is loaded during the operation of the library, which conflicts with Google Chrome Extension Manifest V3 policies. These policies prohibit the inclusion of any remotely hosted code to ensure the security and integrity of Chrome Extensions.
Steps to Reproduce
- Install the latest version of
@amplitude/analytics-browser. - Integrate it into a Chrome Extension project using Manifest V3.
- Submit the extension to the Chrome Web Store.
- The submission will fail due to the inclusion of remotely hosted code.
Expected Behavior
The @amplitude/analytics-browser library should not load any remote scripts to comply with Chrome Extension Manifest V3 policies. Instead, all required scripts should be included within the extension package.
Current Workaround
Downgrading to version 2.9.2 of @amplitude/analytics-browser resolves the issue as this version does not include the problematic remote script.
Request
Please consider removing the remote script loading in future versions of @amplitude/analytics-browser or providing an option to disable this behavior. This change is essential for users who need to comply with Chrome Extension security requirements.
Thank you for your attention to this matter.
+1, I have the same issue
+1, just got my extension update rejected because of this
+1
+1
+1