Chrome Extension

Chrome extension (Manifest V3)

An MV3 extension is three isolated JavaScript contexts that never share memory and only talk via messages:

1. Service worker (background.service_worker) — the logic and lifecycle brain. Ephemeral: Chrome kills it when idle and restarts it on the next event. It has no DOM and no window.
2. Content scripts — run inside a web page, can read/write that page's DOM, live in an isolated JS world by default. No access to most chrome.* APIs except messaging and storage.
3. UI surfaces — popup (action.default_popup), options page, side panel. Normal web pages that load and unload as the user opens/closes them.

Internalize that picture first. Most extension bugs are someone treating one of these as if it shared state with another. They do not. The wire between them is chrome.runtime messaging and chrome.storage.

Manifest V3 is the only version the Chrome Web Store accepts; MV2 phase-out began June 2024 and is still rolling out. Build MV3 from the start.

Pick a skeleton

Default to Vite + CRXJS the moment you want TypeScript or a framework popup — it does the manifest wiring and HMR for you. Reach for vanilla only for a one-file experiment.

Minimal tree (Vite + CRXJS):

my-ext/
  manifest.json        # source of truth; CRXJS reads it
  src/
    background.ts       # service worker
    content.ts          # content script
    popup/
      index.html
      popup.tsx
  public/icons/         # 16, 48, 128 px PNGs
  vite.config.ts
  # build output -> dist/  (this is what you zip)

manifest.json — minimum viable shape

{
  "manifest_version": 3,
  "name": "Highlighter",
  "version": "1.0.0",
  "description": "Highlights selected text on the current page.",
  "icons": { "16": "icons/16.png", "48": "icons/48.png", "128": "icons/128.png" },
  "action": { "default_popup": "popup/index.html" },
  "background": { "service_worker": "background.js", "type": "module" },
  "permissions": ["activeTab", "storage", "scripting"],
  "host_permissions": [],
  "minimum_chrome_version": "120"
}

Rules that fail review or break the worker if you get them wrong:

• manifest_version must be 3. There is no 2 path forward.
• background.service_worker is a string, not an array. There is no background.scripts and no background.page in MV3. The persistent key does not exist — delete it. (Source: developer.chrome.com "Migrate to a service worker", accessed 2026-06-02.)
• "type": "module" lets the worker use import. Use it if you bundle.
• Keep host_permissions empty until you can name exactly which sites and why (see permission table).

The three contexts and how they talk

The service worker is ephemeral. It terminates when idle and wakes on an event. Two consequences govern almost all your code:

• Register every listener synchronously at the top level. If you call chrome.runtime.onMessage.addListener inside an async callback or after an await, Chrome may not have registered it when it wakes the worker, and your event is lost. (Source: developer.chrome.com "Migrate to a service worker", accessed 2026-06-02.)
• Never keep state in a global variable. The worker dies and your variable resets to its initial value. Persist to chrome.storage.

// Bad — global resets to 0 every time the worker is killed and restarts
let clickCount = 0;
chrome.action.onClicked.addListener(() => {
  clickCount++;                          // silently back to 1 after idle
});

// Good — durable across worker restarts, listener registered at top level
chrome.action.onClicked.addListener(async () => {
  const { clickCount = 0 } = await chrome.storage.local.get("clickCount");
  await chrome.storage.local.set({ clickCount: clickCount + 1 });
});

Messaging choices:

• One-shot request/response: chrome.runtime.sendMessage(msg) / chrome.tabs.sendMessage(tabId, msg) paired with chrome.runtime.onMessage. Return true from the listener to keep the channel open for an async sendResponse.
• Long-lived stream (e.g. a content script feeding the popup continuously): chrome.runtime.connect() → Port, with port.onMessage / port.postMessage.

Content script → service worker → popup: there is no direct content-script-to-popup channel when the popup is closed. Route through the worker or through chrome.storage and let the popup read on open.

Permissions — least privilege or you get rejected

Reviewers reject broad permissions with no justification, and broad host_permissions trigger a scary install-time warning that tanks conversion. Declare the narrowest thing that works.

Rule: write a one-sentence justification for every permission before you add it. If you cannot, drop it. activeTab covers more cases than people expect — try it first. (Source: developer.chrome.com "Declare permissions" + "declarativeNetRequest", accessed 2026-06-02.)

Content scripts: declarative vs programmatic

// Declarative — in manifest. Runs automatically on matching pages.
"content_scripts": [{
  "matches": ["https://example.com/*"],
  "js": ["content.js"],
  "run_at": "document_idle"
}]

// Programmatic — inject on a gesture. Needs "scripting" + activeTab or a host match.
chrome.action.onClicked.addListener(async (tab) => {
  await chrome.scripting.executeScript({
    target: { tabId: tab.id },
    files: ["content.js"],
  });
});

• run_at: document_start (before DOM), document_end, or document_idle (default, after load). Pick document_start only if you must beat the page's own scripts.
• Isolated world (default): your content script's JS is sandboxed from the page's JS — they share the DOM but not variables. Use MAIN world ("world": "MAIN") only when you must touch the page's own JS objects, and know it loses the isolation guarantee.
• For dynamic, user-supplied injection, chrome.userScripts.execute() exists (Chrome 135, Mar 2025) — see references/store-and-migration.md.

Storage, alarms, no remote code

• chrome.storage.local (10 MB, larger with unlimitedStorage) for most data; chrome.storage.sync (100 KB, ~8 KB/item) only for small settings you want to follow the user across devices.
• setTimeout/setInterval are unreliable in the worker — it may be asleep when they fire. Use chrome.alarms for anything beyond a few seconds. (Source: developer.chrome.com "Migrate to a service worker", accessed 2026-06-02.)
• Remotely hosted code is banned. No <script src="https://cdn...">, no eval-of-fetched-string. All executable JS must ship inside the package — bundle every dependency. This is enforced by MV3's CSP and by review. (Source: developer.chrome.com "What is Manifest V3", accessed 2026-06-02.)

Shipping to the Chrome Web Store

1. Build, then zip the dist/ output — never the repo. No node_modules, no .git, no source maps you do not want public.
2. Pay the one-time $5 USD developer registration (covers up to 20 extensions on the account).
3. Upload the zip in the Developer Dashboard.
4. Listing assets: a 128×128 PNG icon, at least one screenshot (1280×800 or 640×400), a clear description, a category, and a privacy-policy URL if you collect any data.
5. Review is typically 1–3 business days (simple extensions often under 24h).

(Source: developer.chrome.com "Register your developer account" + fee guide, accessed 2026-06-02.) For the full dashboard walkthrough, data-disclosure form, staged rollout, appeals, and the MV2→MV3 migration map, see references/store-and-migration.md.

Anti-patterns

Run scripts/verify.sh <dir> to lint a produced manifest.json against the MV3 invariants above.