Question

I know it’s not possible to load and run an external script in manifest V3, but is it possible to achieve the same goal?

Requirements

Currently, I have manifest V2 where I dynamically override content-security-policy to add my domain, then inject a script tag to load js from my domain, which then makes API calls to my domain. I need to be able to inject the script on every webpage.

Proposal

I haven’t tried it, yet, but it seems like I can download and include the script directly in the extension, and then use CORS calls (client adds withCredentials to request, and server dynamically adds origin or else credentials won’t work). Will this work? Or is there a better way that’s more secure?