"This extension is not trusted by Enhanced Safe Browsing"

[Ibrahim]

Hello,

I uploaded a new MV3 extension to Chrome Web Store and it got approved. However, when I try to install it on one of my Chrome profiles, I get this warning message:

"This extension is not trusted by Enhanced Safe Browsing"

This extension is a beta version of an already existing extension from the same developer account, and it's published as Unlisted.

The developer account is not new, and I already have another extension with 10.000+ users. That extension does not have this warning though.

It's not a big deal right now, but I would like to know what is the cause of this so I can try to fix it or avoid it, especially before updating the main extension.

The extension id is: cgdofifkggagondhlalkbfpdgneifkkk

Thanks!

[Stefan vd]

Hi Ibrahim,

Is it a new Chrome extension? You can normally install the Chrome extension by clicking on "Continue to install".

Here is the help page that can help you, I quote:

For additional protection when you install a new extension from the Chrome Web Store, you can use Enhanced Safe Browsing. If you enable Enhanced Safe Browsing in Chrome, it warns you when an extension that you want to install isn’t trusted. Extensions are considered trusted when they’re built by a developer who follows the Chrome Web Store Developer Programme Policies.

For new developers, it generally takes a few months to become trusted. Eventually, we strive for all developers with compliant extensions to reach this status upon meeting our Developer Programme Policies.

Install trusted extensions

When you try to install an extension, a dialogue appears.

• If the extension that you’re about to install isn’t trusted by Enhanced Safe Browsing, it says 'This extension is not trusted by Enhanced Safe Browsing'.
  • To install the extension anyway, click Continue to install.
  • To abort the installation, click Close.
• If the extension is trusted by Enhanced Safe Browsing, click Add extension to complete the installation.

Source: https://support.google.com/chrome_webstore/answer/2664769?hl=en-GB

Thanks,

Stefan vd

[Ibrahim]

Thanks for the answer, but I think there is a misunderstanding here.

I wanted to know what could be the reason for my new extension for which it was flagged with the "not trusted by Enhanced Safe Browsing" status.

My developer account is not new. It was created about 6 years ago and I already have another active extension, and that one does not have this warning.

I'm more interested if the reason for flagging it has anything to do with the code or with the functionality, so I can address that on my transition to MV3.

[Simeon Vincent]

Ibrahim, would you mind sharing the IDs of your trusted and untrusted extensions? Feel free to reply directly to me if you're not comfortable sharing them publicly.

Simeon - @dotproto

Chrome Extensions DevRel

--
You received this message because you are subscribed to the Google Groups "Chromium Extensions" group.
To unsubscribe from this group and stop receiving emails from it, send an email to chromium-extens...@chromium.org.
To view this discussion on the web visit https://groups.google.com/a/chromium.org/d/msgid/chromium-extensions/f878aad0-a621-498c-bedd-9671bad80b0cn%40chromium.org.

[Ibrahim]

Sure, 

The untrusted extension ID: cgdofifkggagondhlalkbfpdgneifkkk

And the trusted extension ID: gchcfdihakkhjgfmokemfeembfokkajj

Thank you!

[SATISH B]

I've same problem with my app. It's driving some users away. They see this message and shy away from installing it :-( 

My extension ID: kmphdnilpmdejikjdnlbcnmnabepfgkh

[Chaitanya Asawa]

We're seeing this as well for our extensions at Glean. Chrome seems to be rolling Enhanced Protection out to more users. This is a major problem for us, where users are being scared away because of this labeling – even though our extension has provided tremendous value to users/customers for a while!

Our extension IDs are cfpdompphcacgpjfbonkdokgjhgabpij and cmnbeclkcipbhgnaabhogngjebnkkcai.

We have been developing on these extensions for years with respect to the Developer Program Policies, and as such, we should have met the trusted criteria for "a few months". We follow all the Content guidelines, care deeply about Security, don't spam the web store, limit permission use to what is needed, don't have ads in the product, etc.

Please let us know if there's any more info we can provide; this is extremely critical to us.

[Jamie Murdock]

THIS IS HARMING NOT HELPING! 

• How can I, a user, make an informed decision with zero data on WHY an extension is being flagged as not trusted?
• Are the rest not so labeled now somehow "trusted" by Chrome and Google? 

I tried clicking "Learn more" and ended up here with no content that even mentions what is going on, what the risks are, why a particular extension "is not trusted" or why any browser extension might not be trusted.

Now I see the developer doesn't even know why their work is flagged this way!

Imagine a sticker found IN THE OWNERS MANUAL of your car that said "your car is not trusted. Our reasons for saying this are proprietary." This makes the owner at a loss for making any kind of informed decision! 

What should I do?

•  Never start the car again? 
• Or ignore this as lawyer talk? 
• Will my model of car sometimes have a wheel fall off because this car model has a history of this happening?
• Or what if the reason was that my car a new model that has not yet been crash dummy tested by IIHS, yet is is made by Subaru having a history of strong occupant protection (or Nisson that doesn't seem to get it right on their cars*). I need to know what is behind "not trusted"! (*ref:  https://www.iihs.org/ratings/insurance-losses-by-make-and-model)

Right now, I see this as Chrome extensions is making baseless accusations by saying "This extension is not trusted..." Such language is very assertive, sounding like a case has been made for this. 

• The various Google responses don't convey what "could be said" perhaps things like "this extension does not yet have a good or bad reputation because it is not widely used"  or "this developer has a good reputation on other extensions, but this one is too new to score" or "this developer is new and there isn't enough data to call this a "trusted" extension."

If there is AI or an algorithm, then there is a reason it forms an opinion. The Chrome Extensions page should simply spit that exact reason out, in plain language, for example: 

• (example) "This extension was evaluated by and algorithm that cannot yet assess it as having a good or bad reputation because it is not widely used." ... or 
• (example) "... because it is too new to score however this does have a "trusted" status on 8 of 10 other extensions"

Jamie

[HN]

I have the same problem as well, some users are complaining and I have no idea why my extension is considered a threat and what can I do to resolve the warning. 
Anyone figured out how to resolve this ? 

[Andrew Grosset]

So the Chrome webstore now serves extensions that are not trusted? 

If they're suspicious, "dodgy",  not secure or not trusted why are they on the web store at all?

[Uğur]

One of my client has faced with this problem too. Any reason why we are seeing this? besides "being new developer"?  Has anyone find a solution?

[kin...@gmail.com]

Still an issue in June 2024.. did this resolve itself after a period of time?

[Francois Devatine 馮韋元 (法國台客)]

Starting this thread again with the following question:

Our company has a publishing group with multiple email addresses able to publish extensions.

Our extensions within the group have the badge mentioning having a good record with no history of violations.

Recently a new account part of the publishing group has submitted an extension. The extension doesn't have this badge, and is flagged by the Enhanced safe browsing message.

I'd like to understand more about the mechanism that gives the badge. My understanding is that if the publishing group has a good reputation, all the accounts part of the publishing group should be able to upload a new extension into the group?

[Robby Frank]

Bumping this - any update, how to remove this?

[Francois Devatine 馮韋元 (法國台客)]

After some investigation on my side I believe there is a couple of things:

- If your company owns a particular website associated to what the extension does, the field "Additional fields" can be used to specify that website (the author needs to be an owner of the domain in the Google Search Console). That is the case of my post above - our other extensions had that setting, but the new extension didn't, therefore it didn't have the badge.

- General case is that you earn the trust over time, if your extensions have no history of violations or issues, eventually it should gain the trust and that popup should go away

- Speculating that there are other parameters into account, such as reviews, number of stars, number of users who installed the extension

[Marcin Berdys]

Do my little funny extension need it's own domain and website so it can become trusted?
It just scrolls the page and nothing else!
id:  deifnncafaakgmbpdckdolcekfeaigdc   
Is own domain a demand to become trusted developer?

Does anybody check the code to confirm it's safe?