---
title: "Manifest V3 chrome.scripting.executeScript: Code injection vs pre-injected scripts."
description: "Deep dive into Chrome Manifest V3 chrome.scripting vs persistent content_scripts. Learn why on-demand execution on user gesture is safer than running code on every page load."
canonical_url: "https://vezz.me/permissions/scripting-execute-script-security/"
type: "pseo-permissions"
category: "permissions"
topic: "Manifest V3 Script Execution"
intent: "Best for developers, AppSec teams, and security reviewers evaluating code injection patterns in modern browser extensions."
---

# Manifest V3 chrome.scripting.executeScript: Code injection vs pre-injected scripts.

Deep dive into Chrome Manifest V3 chrome.scripting vs persistent content_scripts. Learn why on-demand execution on user gesture is safer than running code on every page load.

> **Best fit:** Best for developers, AppSec teams, and security reviewers evaluating code injection patterns in modern browser extensions.

## Technical Permission Audit

- **Manifest Key:** `scripting`
- **Chrome Install Warning:** None (when paired with activeTab) / Broad warnings if paired with host_permissions
- **Risk Level:** Medium

```json
// Background Service Worker
chrome.action.onClicked.addListener(async (tab) => {
  if (!tab.id) return;
  // Executes strictly on the active tab upon explicit user gesture
  await chrome.scripting.executeScript({
    target: { tabId: tab.id },
    func: () => window.getSelection()?.toString() || ""
  });
});
```

### Legitimate Uses
- Reading the user's highlighted text selection (`window.getSelection()`) strictly when a keyboard shortcut or toolbar icon is triggered
- Rendering an ephemeral overlay card on top of the active page that dismisses cleanly with Esc
- Extracting page headings and semantic context for the currently active tab on demand

### Red Flags to Watch For
- Injecting obfuscated or remote scripts (`eval()`, third-party CDNs) into every loaded tab
- Pairing `scripting` with `<all_urls>` to inject keyloggers or DOM scrapers automatically without user interaction
- Injecting scripts into banking or auth frames without explicit user request

**How Vezz me handles this:** Vezz me does NOT use broad background injection. When you press Ctrl+Shift+X, Chrome grants temporary `activeTab` access, allowing the extension to read the selected text string and mount a lightweight modal overlay that is removed on dismiss.

## Step-by-step workflow

1. **Distinguish persistent content scripts from on-demand execution**: Persistent `content_scripts` execute on every page load across millions of domains 24/7. On-demand execution (`activeTab`) runs only when you physically trigger a shortcut.
2. **Check whether scripts are packaged locally or fetched remotely**: Manifest V3 strictly forbids remotely hosted code. Vezz me is 100% locally packaged and verified by Chrome Web Store and Mozilla Add-on automated reviews.
3. **Verify clean DOM removal on dismiss**: When you press Esc or click outside the Vezz me popup, the overlay DOM element is completely removed from the page.

## The principle of on-demand execution

Browser extensions should be inert until called upon by the user.

- Eliminates memory leaks and CPU overhead from running DOM observers on thousands of background tabs
- Prevents third-party scripts from inspecting banking, password, or medical form inputs
- Adheres strictly to the least-privilege security model enforced by Chromium and Gecko

## Script Execution Models in Browser Extensions

Comparing on-demand activeTab execution with persistent content scripts.

| Execution Model | Runs On Every Tab Load? | Access Without User Click |
| --- | --- | --- |
| On-Demand activeTab (Vezz me) | No (only when Ctrl+Shift+X is pressed) | Impossible (browser blocks access until user gesture) |
| Persistent content_scripts on <all_urls> | Yes (runs on every HTTP/HTTPS frame) | Full access 24/7 without user awareness |
| scripting + broad host permissions | Can programmatically inject into any tab anytime | High risk if extension is compromised or sold |

## Frequently asked questions

### Does Vezz me inject scripts before I press Ctrl+Shift+X?

Never. Vezz me has zero persistent content scripts declared in its manifest. It cannot run code in your tab until you press the shortcut or click the icon.

### Can Vezz me interfere with complex web apps like Figma or Google Sheets?

No. Because Vezz me is dormant until invoked, it has zero impact on application performance, canvas rendering, or complex event listeners.

### Where can I read our detailed scripting permission audit?

See our dedicated technical breakdown: Chrome Extension scripting Permission Audit.

## Related guides

- [Chrome Extension scripting Permission Audit](https://vezz.me/permissions/scripting/): Comprehensive guide to Manifest V3 scripting security.
- [activeTab Permission Security Guide](https://vezz.me/permissions/activetab/): How user-gesture activation guarantees safety.
- [AI Chrome Extension Permission Checker](https://vezz.me/ai-chrome-extension-permission-checker/): Audit any extension manifest for persistent content scripts.
- [Host Permissions (<all_urls>) Audit](https://vezz.me/permissions/host-permissions-all-urls/): Why <all_urls> is the biggest vulnerability vector in extensions.