Chromium Blog: chrome web store

Changes to the Chrome App Support Timeline

pondělí 10. srpna 2020

NOTE: The timeline has been updated, please see our October 2021 post for more details.

In January 2020, we announced that we are expanding our phased approach for ending the support of Chrome Apps. That announcement was made due to significant progress of the modern Web and its ability to deliver first class user experiences for users. We continue to invest in rich new capabilities on the Web platform and are committed to pushing the Web forward.

Based on feedback from our customers and partners, we are making the following adjustments to the Chrome app support timeline, with modifications highlighted in bold:

Scheduled Date	Action
March 2020	Chrome Web Store stopped accepting new public Chrome apps. Developers will be able to update existing Chrome apps through June 2022. Enterprise administrators may continue to submit new private and unlisted Chrome apps to the Chrome Web Store.
June 2021	General support for Chrome Apps on Windows, Mac, and Linux will end June 2021. Organizations will be able to use a policy setting to extend support on Windows, Mac, and Linux through June 2022. General support for Chrome Apps on Chrome OS will remain enabled, without requiring any policy setting, through June 2022.
June 2022	Chrome Web Store will stop accepting new and updated private and unlisted Chrome apps. End support for Chrome Apps, NaCl, PNaCl, and PPAPI for all platforms.

This change does not impact support for Chrome Extensions. Google will continue to support and invest in Chrome Extensions on all existing platforms. Fostering a robust ecosystem of extensions is critical to Chrome's mission and we are committed to providing a useful extension platform for customizing the browsing experience for all users.

For additional support with Chrome app migration, please visit our Chrome Apps migration site. This page will be kept up to date as we progress together through this process.

We thank our community of developers who have provided feedback to help us shape this modified and simplified approach. We are inspired by a future beyond Chrome apps, where the ecosystem continues forward progress leveraging open Web standards across all modern browsers.

Posted by Anthony Laforge, Technical Director, Chrome Platform Team

Keeping spam off the Chrome Web Store

středa 29. dubna 2020

Since the introduction of the Chrome Web Store in 2011, it has become the largest catalog of browser extensions with over 200,000 available to all of our users. This has helped millions of users to customize their browsing experience on Chrome in ways we could have never imagined, from niche utilities to companies building businesses around the platform’s capabilities.

In response, our abuse systems and review teams have been hard at work ensuring that the Chrome Web Store is free from abuse, as many of our developers have noticed an increase in review times lately. However, the increase in adoption of the extension platform has also attracted spammers and fraudsters introducing low-quality and misleading extensions in an attempt to deceive and trick our users into installing them to make a quick profit. We want to ensure that the path of a user discovering an extension from the Chrome Web Store is clear and informative and not muddled with copycats, misleading functionalities or fake reviews and ratings. Therefore, in order to keep the quality of our inventory high and help users find what they want, we’re introducing some updates to our spam policy:

Developers or their affiliates should not publish multiple extensions that provide duplicate experiences or functionality on the Chrome Web Store.

Extensions should not have misleading, improperly formatted, non-descriptive, irrelevant, excessive, or inappropriate metadata, including but not limited to the extension’s description, developer name, title, icon, screenshots, and promotional images. Developers must provide a clear and well-written description. Unattributed or anonymous user testimonials in the app's description are also not allowed.

Developers must not attempt to manipulate the placement of any extensions in the Chrome Web Store. This includes, but is not limited to, inflating product ratings, reviews, or install counts by illegitimate means, such as fraudulent or incentivized downloads, reviews and ratings.

Extensions with a single purpose of installing or launching another app, theme, webpage, or extension are not allowed.

Extensions that abuse, or are associated with the abuse of, notifications by sending spam, ads, promotions, phishing attempts, or unwanted messages that harm the user’s browsing experience are not allowed. Extensions that send messages on behalf of the user without giving the user the ability to confirm the content and intended recipients are also not allowed.

The new policy can be found in our updated Developer Program Policies.

Developers must comply with this policy by August 27th 2020. After that date, extensions that violate the updated policy may be taken down and disabled. You can learn more about these changes and how they may apply to you in our Spam policy FAQ.

Posted by Rebecca Soares and Benjamin Ackerman, Chrome Policy and Anti-Abuse Team

New developer dashboard and registration flow for Chrome Web Store

čtvrtek 12. března 2020

Chrome Web Store New dashboard is now the default

When you click Settings > Developer Dashboard on the Chrome Web Store home page.

When you follow existing bookmarks or links to the developer dashboard.

When you navigate explicitly to chrome.google.com/webstore/developer/dashboard.

Opting out means that you’ll see the old dashboard in each of the cases listed above. You can always opt in again by clicking the link in the old dashboard’s banner:

Opting out is useful for specific use cases that affect a small number of developers. The new dashboard does not yet support the following tasks:

Transfer items

Edit or publish a paid item, or add in-app purchases, using Chrome Web Store Payments

View an item’s public key

Re-order screenshots

Preview a new version of your item or promotional tiles

View revenue stats

known issues document Developer registration fee now required earlier

Developers who previously published items to the public were required to pay the registration fee at that time. These developers do not need to pay the fee again: no action is required.

New developers must register and pay this fee before they can use the Chrome Web Store developer dashboard.

Previously registered developers who have never published an item to the public must now pay this fee before they can use the CWS developer dashboard. If you have published to private domain or to trusted testers, but not to the public, you will now need to pay the registration fee. Note: This will look like a new developer registration flow, but all that’s required is to pay the fee and complete the flow.

Project Strobe: Updates to Our User Data Policy

úterý 23. července 2019

We’re requiring extensions to only request access to the least amount of data. While this has previously been encouraged of developers, now we’re making this a requirement for all extensions.

We’re requiring more extensions to post privacy policies, including extensions that handle personal communications and user-provided content. Our policies have previously required any extension that handles personal and sensitive user data to post a privacy policy and handle that data securely. Now, we’re expanding this category to include extensions that handle user-provided content and personal communications. Of course, extensions must continue to be transparent in how they handle user data, disclosing the collection, use and sharing of that data.

Inventory your extensions' current permissions and, where possible, switch to alternatives that are more narrowly scoped. Additionally, include a list of permissions used and the reasons you require them in your Chrome Web Store listing or in an "about page" in your extension. If you expand the features of your extension and require a new permission, you may only request the new permission in the updated version of the extension.

If your extension handles Personal or Sensitive User Data, which now also includes, user-provided content and personal communications, your Product must both post a privacy policy and handle the user data securely, including transmitting it via modern cryptography. To add a privacy policy, use the developer dashboard to link to your privacy policy with your developer account. All your published extensions share the same privacy policy.

User Data FAQ.
Posted by Alexandre Blondin and Swagateeka Panigrahy, Chrome Product & Policy

Taking Action on Deceptive Installation Tactics

čtvrtek 30. května 2019

Privacy, security and transparency are at the forefront of all the work we do on Chrome. In October, we announced changes aimed at ensuring Chrome extensions are trustworthy by default, but the work doesn’t end there.

As part of our commitment to transparency, we are announcing a new policy targeting deceptive installation tactics for extensions on the Chrome Web Store. We’ve seen that the path to downloading a Chrome extension influences user trust in all extensions. One bad experience can affect a user’s interest in the many great extensions our developers create. Setting the right expectations for what an extension does, from the start, helps create a healthy and thriving ecosystem of extensions, developers, and passionate users.

Last year, to improve user transparency we deprecated inline installation and began requiring all extension installs to go through the Chrome Web Store. This change has helped reduce user complaints about unwanted extensions by 18 percent. However, we still receive user feedback about deceptive extension install flows. As user transparency is an important part of our ecosystem, we are continuing to push these initiatives forward by prohibiting extensions that benefit from deceptive install tactics with the following policy:

Extensions must be marketed responsibly. Extensions that use or benefit from deceptive installation tactics will be removed from the Chrome Web Store.

Deceptive installation tactics include:

Unclear or inconspicuous disclosures on marketing collateral preceding the Chrome Web Store item listing.

Misleading interactive elements as part of your distribution flow. This includes misleading call-to-action buttons or forms that imply an outcome other than the installation of an extension.

Adjusting the Chrome Web Store item listing window with the effect of withholding or hiding extension metadata from the user.

Please audit all of your install traffic to ensure it is compliant before July 1st, 2019. You can also find an FAQ on the new policy in the Chrome Developer Center.

Today, we also announced additional policies to further protect users as part of Google’s Project Strobe. We will be requiring that extensions request the narrowest permissions needed to implement their features, and requiring more extensions to post privacy policies and handle user data securely. Read more about those changes in the Keyword post and the Chrome Developer Center FAQ.

Posted by Swagateeka Panigrahy and Benjamin Ackerman, Chrome Policy and Anti-Abuse Team

Trustworthy Chrome Extensions, by default

pondělí 1. října 2018

li { line-height: 1.38 !important; } Incredibly, it’s been nearly a decade since we launched the Chrome extensions system. Thanks to the hard work and innovation of our developer community, there are now more than 180,000 extensions in the Chrome Web Store, and nearly half of Chrome desktop users actively use extensions to customize Chrome and their experience on the web.
The extensions team's dual mission is to help users tailor Chrome’s functionality to their individual needs and interests, and to empower developers to build rich and useful extensions. But, first and foremost, it’s crucial that users be able to trust the extensions they install are safe, privacy-preserving, and performant. Users should always have full transparency about the scope of their extensions’ capabilities and data access.
We’ve recently taken a number of steps toward improved extension security with the launch of out-of-process iframes, the removal of inline installation, and significant advancements in our ability to detect and block malicious extensions using machine learning. Looking ahead, there are more fundamental changes needed so that all Chrome extensions are trustworthy by default.
Today we’re announcing some upcoming changes and plans for the future:
User controls for host permissions Beginning in Chrome 70, users will have the choice to restrict extension host access to a custom list of sites, or to configure extensions to require a click to gain access to the current page.

While host permissions have enabled thousands of powerful and creative extension use cases, they have also led to a broad range of misuse - both malicious and unintentional - because they allow extensions to automatically read and change data on websites. Our aim is to improve user transparency and control over when extensions are able to access site data. In subsequent milestones, we’ll continue to optimize the user experience toward this goal while improving usability. If your extension requests host permissions, we encourage you to review our transition guide and begin testing as soon as possible.

Changes to the extensions review process Going forward, extensions that request powerful permissions will be subject to additional compliance review. We’re also looking very closely at extensions that use remotely hosted code, with ongoing monitoring. Your extension’s permissions should be as narrowly-scoped as possible, and all your code should be included directly in the extension package, to minimize review time.

New code readability requirements Starting today, Chrome Web Store will no longer allow extensions with obfuscated code. This includes code within the extension package as well as any external code or resource fetched from the web. This policy applies immediately to all new extension submissions. Existing extensions with obfuscated code can continue to submit updates over the next 90 days, but will be removed from the Chrome Web Store in early January if not compliant.
Today over 70% of malicious and policy violating extensions that we block from Chrome Web Store contain obfuscated code. At the same time, because obfuscation is mainly used to conceal code functionality, it adds a great deal of complexity to our review process. This is no longer acceptable given the aforementioned review process changes.
Additionally, since JavaScript code is always running locally on the user's machine, obfuscation is insufficient to protect proprietary code from a truly motivated reverse engineer. Obfuscation techniques also come with hefty performance costs such as slower execution and increased file and memory footprints.
Ordinary minification, on the other hand, typically speeds up code execution as it reduces code size, and is much more straightforward to review. Thus, minification will still be allowed, including the following techniques:

Removal of whitespace, newlines, code comments, and block delimiters

Shortening of variable and function names

Collapsing the number of JavaScript files

If you have an extension in the store with obfuscated code, please review our updated content policies as well as our recommended minification techniques for Google Developers, and submit a new compliant version before January 1st, 2019.

Required 2-Step Verification

In 2019, enrollment in 2-Step Verification will be required for Chrome Web Store developer accounts. If your extension becomes popular, it can attract attackers who want to steal it by hijacking your account, and 2-Step Verification adds an extra layer of security by requiring a second authentication step from your phone or a physical security key. We strongly recommend that you enroll as soon as possible.

For even stronger account security, consider the Advanced Protection Program. Advanced protection offers the same level of security that Google relies on for its own employees, requiring a physical security key to provide the strongest defense against phishing attacks.

Looking ahead: Manifest v3

In 2019 we will introduce the next extensions manifest version. Manifest v3 will entail additional platform changes that aim to create stronger security, privacy, and performance guarantees. We want to help all developers fall into the pit of success; writing a secure and performant extension in Manifest v3 should be easy, while writing an insecure or non-performant extension should be difficult.

Some key goals of manifest v3 include:

More narrowly-scoped and declarative APIs, to decrease the need for overly-broad access and enable more performant implementation by the browser, while preserving important functionality
Additional, easier mechanisms for users to control the permissions granted to extensions
Modernizing to align with new web capabilities, such as supporting Service Workers as a new type of background process

We intend to make the transition to manifest v3 as smooth as possible and we’re thinking carefully about the rollout plan. We’ll be in touch soon with more specific details.
We recognize that some of the changes announced today may require effort in the future, depending on your extension. But we believe the collective result will be worth that effort for all users, developers, and for the long term health of the Chrome extensions ecosystem. We’re committed to working with you to transition through these changes and are very interested in your feedback. If you have questions or comments, please get in touch with us on the Chromium extensions forum.
Posted by James Wagner, Chrome Extensions Product Manager

Using WebP to Improve Speed

čtvrtek 7. února 2013

WebP35% betterover 60%Chrome Web StoreWebPJPEGseveral terabytesMake the Web FasterWebPPosted by Stephen Konig, Product Manager

Updates to manifest V1 Chrome Web Store items to be blocked in March

středa 6. února 2013

manifest V2Content Security Policymanifest version support scheduleChrome Web Storeblock all updatesmigration tutorialchromium-apps forumour G+ pagePosted by Joe Marini, Developer Advocate

Build Chrome Packaged Apps with the MediaGalleries API

úterý 20. listopadu 2012

Google Play MusicYouTubeChrome packaged app developersMedia Galleries API

read-only: allows media content to be read, but not modified

read-write: allows media content to be read and modified

add-files: allows media to be added to the galleries but prevents modifying existing media files.

getMediaFilesystems()

LocalFileSystemW3C FileSystem API

NOTEnatively supportsasynchronous versionsamples repositorysample applicationchromium-appsGoogle+ page
Posted by Joe Marini, Developer Advocate

Restricting extension APIs in legacy packaged apps

čtvrtek 15. listopadu 2012

legacy packaged apps< all urls >" (b) the top-level "content_scripts" key (c) the "debugger", "devtools", "pageCapture", "plugin", "proxy", "tabs'", "history", "webNavigation" permissions (d) the top-level "npapi" key
Existing legacy packaged apps in the Chrome Web Store will not be affected, and those existing apps can continue to be updated without being subject to these new restrictions. Chromium extensionsChromium apps
Posted by Peter Ludwig, Product Manager

Introducing TCP Listen, a new API for Chrome packaged apps

pátek 2. listopadu 2012

Chrome packaged appsmany othersTCP Listenearlier this yearMedia Center applicationHTTP serverautomate a browser windowMedia Center applicationDLNA®/UPnP

GitHub repositorywebserverTCP serverChrome Apps Office Hourschromium-apps
Posted by Renato Mangini, Developer Advocate

Smarter NPAPI installs from the Chrome Web Store

středa 31. října 2012

Chrome Web StoreNPAPIrequirements"requirements": { "plugins": { "npapi": false } }Native Clientdeveloper forum
Posted by Joe Marini, Developer Advocate

New site ownership verification option in CWS

pátek 19. října 2012

Chrome Web StoreGoogle’s Webmaster Toolsdeveloper dashboard

Notedeveloper forumWebmaster Help forum
Posted by Joe Marini, Developer Advocate

The evolution of Chrome packaged apps

čtvrtek 9. srpna 2012

we announced Check out our overview video for a quick intro to the new platform. developer channelChrome Web Storedeveloper.chrome.com/appssample applicationschromium-appsreport an issuereminder to your calendarGoogle Developers Live+Google Chrome Developers
Posted by Mike Tsao, Evolved Software Engineer

Put your extensions on a diet with event pages

čtvrtek 21. června 2012

Event PagesHow They Work background pagesevent page documentation

The alarms API allows an extension to wake itself up at set times, to support features like periodically syncing data to the cloud.

Some new events let extensions know when they have been installed, or when their event page is being unloaded.

A declarative version of the webRequest API lets extensions do network interception without the need for a background page at all.

Try it Out developer channellet us know
Posted by Matt Perry, Software Engineer

Customer Feedback Improvements in the Chrome Web Store

středa 20. června 2012

Turning the Feedback Feature On

Engaging With Your Users”. developer forum
Posted by Siddhartha Saha, Software Engineer

Make your website faster with PageSpeed Insights

úterý 12. června 2012

Cross-posted from the Google Developers Blog.PageSpeed InsightsChrome Web Store

Native ClientPageSpeed Insights SDKPageSpeed Insights for Chromemailing list
Posted by Libo Song and Bryan McQuade, Software Engineers

New Developer Features in the Chrome Web Store

úterý 12. června 2012

Chrome Web StoreNew Countries localizing your appsNew Offline Apps Collectionspecial collection

offline_enabledmanifest fileBetter Information in the Developer Dashboard

developer forumPosted by Joe Marini, Developer Advocate

Inline installation for your apps and extensions

pondělí 19. března 2012

Chrome Web Storeinline installation

Chrome extensions Evernote Clearly and Evernote Web Clipper derive 15% and 25% of their Chrome installations (respectively) from their inline installation implementation

Rovio implemented inline installation for their Angry Birds Chrome game and saw their install rate jump by almost 10%)

Equire, a CRM extension that integrates with Gmail, saw a 66% increase in Chrome user retention after they implemented inline installation.

Example: Installing Evernote Web Clipper from Evernote’s Site

Provide a link to your Chrome Web Store item.
Write some script to check for whatever client-side capabilities your app requires (support for WebGL, the Web Audio API, etc). Modernizr is a great library to use for this.
Call a JavaScript function to initiate the install process.

The user sees the same Add To Chrome dialog prompt that they would on the store, confirm the install, and they're done – all without leaving your site.
The full details and documentation for using inline installation can be found here. If you have any questions, you can reach us on our developer forum.

Posted by Joe Marini, Developer Advocate

Chrome@GDC Recap

pátek 16. března 2012

Game Developers ConferenceNative ClientAirMechFrom Dust4 brand new case studiesgame developer site
Posted by Christian Stefansen, Product Manager

Chromium Blog