Extensions using Manifest V3 must meet additional requirements related to the extension's code. Specifically, the full functionality of an extension must be easily discernible from its submitted code. This means that the logic of how each extension operates should be self contained. The extension may reference and load data and other information sources that are external to the extension, but these external resources must not contain any logic. Some common violations include:
Including a <script> tag that points to a resource that is not within the extension's package
eval()method or other mechanisms to execute a string fetched from a remote source
Building an interpreter to run complex commands fetched from a remote source, even if those commands are fetched as data
Communicating with remote servers for certain purposes is still allowed. For instance:
Syncing user account data with a remote server
Fetching a remote configuration file for A/B testing or determining enabled features, where all logic for the functionality is contained within the extension package
Fetching remote resources that are not used to evaluate logic, such as images
Performing server-side operations with data (such as for the purposes of encryption with a private key)
If our reviewers are unable to determine the full functionality of your extension during the review process, we may reject your submission or remove it from the store.
Except as otherwise noted, the content of this page is licensed under the Creative Commons Attribution 4.0 License, and code samples are licensed under the Apache 2.0 License. For details, see the Google Developers Site Policies. Java is a registered trademark of Oracle and/or its affiliates.
Last updated 2022-11-01 UTC.