{
  "manifest_version": 2,
  "name": "CSP3 script-src-elem passthrough (VULN)",
  "version": "1.0",
  "description": "Demonstrates that ExtensionCSPEnforcer fails to sanitize script-src-elem / script-src-attr, allowing them to override the secured script-src at runtime.",
  "content_security_policy": "script-src 'self'; script-src-elem 'self' 'unsafe-inline' data: https: http:; script-src-attr 'unsafe-inline'",
  "background": {
    "scripts": ["background.js"],
    "persistent": true
  },
  "permissions": ["tabs"]
}