{
  "manifest_version": 3,
  "name": "userScripts.execute TOCTOU POC",
  "version": "1.0",
  "description": "Demonstrates TOCTOU between CanAccessTarget() and ExecuteScript() in userScripts.execute() across the async file-load hop.",
  "permissions": [
    "userScripts",
    "webNavigation",
    "tabs"
  ],
  "host_permissions": [
    "http://attacker.test/*"
  ],
  "background": {
    "service_worker": "background.js"
  },
  "content_scripts": [
    {
      "matches": ["http://attacker.test/top.html"],
      "js": ["cs.js"],
      "run_at": "document_idle"
    }
  ]
}