Chrome banned extension for no reason

[Name Team]

We received a message that our extension has been blocked.

> was removed from the Chrome Web Store for engaging in malicious activities harmful to users. Given the nature of this violation the item will not be reinstated.

The extension did not contain an encrypted code and had 470 thousand users.

The extension collected website content data, a checkmark that is indicated in the developer panel.

They do not say the reason, do not allow to fix it, they just banned it and sent it away.

Is it okay? Who can help us?

[Simeon Vincent]

I believe the email you received should have included steps for appealing the decision. That's probably your best course.

I try to help look into review-related issues posted here when I can. If you provide the extension ID I'll see what I can find. Please note, though, that internal processes prevent me from disclosing information about malware verdicts. The good news, though, is that since I don't' currently have access to sensitive information, I can ruminate on what might have caused this issue.

At the moment I suspect that your extension may have been collecting information about the user or their browsing habits that was not directly related to the extension's purpose. For example, if I created an extension that let users save snippets of text from web pages, but the extension also sent data back to my server about what social media accounts the user is logged into, that would be excessive data access. Similarly, if the extension aggregate & transmitted data to my server about the number of times a user specific sites, that would no directly serve the purpose of extension and would violate the user's expectations. Finally, if I decided to use a 3rd party library in my extension, that library may be harvesting user data without my knowledge or consent. In this case CWS would still take action against my extension because without my extension the user's data would not have been harvested and it was my responsibility to ensure that the code I ship is secure & compliant with CWS policy.

Cheers,

Simeon - @dotproto

Chrome Extensions DevRel

[Name Team]

Hi Simeon

We made requests to websites and collected website content (anonymously, without user cookies or any link to it). This item needs to be indicated on the screenshot in the developer's panel, and as I understand it, this should not be considered a violation, or are there other methods to collect data from the pages?

It is also written in our policy of use.

Extension ID is ookhnhpkphagefgdiemllfajmkdkcaim

[Name Team]

no news so far

[Simeon Vincent]

I verified that the item in question was indeed flagged as malware. As previously noted, internal processes prevent me from disclosing details about malware verdicts.

It appears you already have a support request open regarding this takedown; that remains your best channel for getting more information about the verdict. I'd also encourage you to consider the notes I shared in my last email on common malware violations and consider whether any of these issues apply to this extension.

Cheers,

Simeon - @dotproto

Chrome Extensions DevRel

[Name Team]

Why doesn't chrome give details?

How can developers collect website content?

[Erek Speed]

As another random bystander I think your question has a simple answer:

Developers are not allowed to collect website content unless it's the single purpose of the extension.

Probably your app doesn't need any website content to be collected in order to provide its primary function. (It seems like it's a VPN)

--
You received this message because you are subscribed to the Google Groups "Chromium Extensions" group.
To unsubscribe from this group and stop receiving emails from it, send an email to chromium-extens...@chromium.org.
To view this discussion on the web visit https://groups.google.com/a/chromium.org/d/msgid/chromium-extensions/7e6107a4-0cdb-4adb-99bb-b03ce61a7335n%40chromium.org.

[Extension_DEV]

Did your extension ever get reinstated?

[Name Team]

No, and they do not provide any details

[Andrew Beyer]

CWS never provides exact details for the removal or rejection of extensions. They don't want to make public the exact ways to get approved or pulled as malicious developers can use that information to bypass getting caught.