Won't help. You can always execute "code" if you try hard enough. Not all "code" is in the form of some JS file loaded into the extension context: it can be any

Won't help. You can always execute "code" if you try hard enough. Not all "code" is in the form of some JS file loaded into the extension context: it can be any custom sequence of instructions. There is no way to distinguish code from data.