How Does Google Protect Chrome Extension Code?

[Vishal Vats]

Hi team,

For my personal projects using vanilla JS, I always obfuscate scripts to prevent client-side tampering via the inspect panel—it works well.

While working with Chrome extensions, I noticed that key scripts (even background ones) are easily accessible. Frameworks like React or Vue naturally obfuscate most of the UI and logic, but vanilla JS doesn’t get that benefit.

I tested using obfuscated JS in local extension development, and it worked flawlessly. That said, I’m aware Google currently rejects extensions with obfuscated code at submission.

Could there be a future approach where developers place original scripts in a src folder for review, and post-approval, the reviewed code is obfuscated into a dist folder for public release? This could preserve extension integrity and discourage misuse.

Thoughts?

[al]

It's important to differentiate between obfuscation and minification. Frameworks minify, during compilation - from my understanding save on file size among other things.

I can't remember if it's specifically stated, but minification isn't against CWS policy. I'd say frameworks don't get any special treatment. 

If you search for "minification" within this Google group, you should find some of the dev rel folk saying as much.

Obfuscation, in the bytecode sense (or other methods) is against policy. 

In my opinion it should be fine/reasonable to minify code, so long as its parseable for review.

If you're worried about tampering, in my opinion you should warn users via the console that the onus is on them.

And if its to do with accessing data (or code) they shouldn't (e.g. endpoints), then that's standard development (security). 

i.e. never trust your users.

every site on the internet is equally susceptible to that.

[Cuyler Stuwe]

If you're talking about protecting IP: Your browser extension's logic shouldn't be where your company's "secret sauce" lives. Move all of that to the server. This will solve 99.9% of the issues you're concerned about.

--
You received this message because you are subscribed to the Google Groups "Chromium Extensions" group.
To unsubscribe from this group and stop receiving emails from it, send an email to chromium-extens...@chromium.org.
To view this discussion visit https://groups.google.com/a/chromium.org/d/msgid/chromium-extensions/675fbc0e-6d7a-4617-ab2c-3abf3a6c6f58n%40chromium.org.