Modify chrome://newtab

[JP W]

I want to make an extension which changes some of the buttons and background images on the new tab page (should be chrome://newtab?) but I have no idea if I can even allow an extension to modify the contents of chrome://newtab, I know I can replace the newtab page with the extensions custom one but I really would like to modify the original.

Is this possible?

Thanks.

[Oliver Dunk]

Hi JP,

The closest thing to this would likely be the "extensions on chrome:// URLs" flag at chrome://flags, which would allow you to request permission to inject into that page.

That said, that isn't a particularly well supported flag, so unless you have a very specific use case it probably isn't for you - in which case, overriding the entire page may be the best option.

Oliver Dunk | DevRel, Chrome Extensions | https://developer.chrome.com/ | London, GB

--
You received this message because you are subscribed to the Google Groups "Chromium Extensions" group.
To unsubscribe from this group and stop receiving emails from it, send an email to chromium-extens...@chromium.org.
To view this discussion on the web visit https://groups.google.com/a/chromium.org/d/msgid/chromium-extensions/44eba37c-ecdc-4acc-9be2-d79c88981364n%40chromium.org.

[JP W]

Hi Oliver,

Thank you for your prompt reply.

It's a shame this functionality isn't directly integrated into Chromium as I'm sure a lot of extension developers would like to be able to also incorporate browser-specific elements such as frequently viewed pages/shortcuts instead of replacing the pages with limited information like this.

I have tested enabling the experimental flag and it does indeed allow me to modify and inject scripts into Chromium pages, and I think this will suffice for me for now.

Thanks!

[Oliver Dunk]

I definitely appreciate the feedback!

Perhaps something like a widget system could be cool one day but there aren't any plans for that.

Oliver Dunk | DevRel, Chrome Extensions | https://developer.chrome.com/ | London, GB

[Ian Williams]

Hey Oliver, while the widget system might be a pipe dream for now, do you think we can get better support for the flag you mentioned? It's been experimental for a long time, and editing chrome pages could be really useful if added as a full permission. 

[JP W]

Definitely, would be great if it was taken out of being experimental.

Although I think it may have something to do with security, if Chrome tabs can be modified and read by an extension, a malicious extension could read sensitive information on them, example would be the "website passwords" page, especially since extensions don't have very thorough or strict screening procedures in place.

Could be solved maybe with more warnings or blatantly not allowing modification/reads on sensitive chrome pages such as settings, although I think this is already the case.

[Oliver Dunk]

As you've both hinted at, I think this is better described as an advanced feature or something rather than "experimental".

I don't expect this will become available any time soon without a flag because it opens up too large of an attack surface.

Oliver Dunk | DevRel, Chrome Extensions | https://developer.chrome.com/ | London, GB

[Ian Williams]

Thanks for the clarification, Oliver. I just hope the flag doesn't get stealth removed one day. 

Last time I needed to use it, there was a giant banner telling the user to turn off the flag. Ostensibly, the user would want the advanced feature on if he turns on the flag, so could that banner be removed (if it wasn't already)?

[Oliver Dunk]

I'm not aware of any plans to remove it, but don't know enough to say for sure.

I'm also not sure why that message exists, but a possible guess - it's very easy for malicious software to start other software with arbitrary flags. While local attacks are mostly outside of our threat model, I could see that banner being added as a warning "you may think you're running normal Chrome but some of the protections we usually have aren't present".

Oliver Dunk | DevRel, Chrome Extensions | https://developer.chrome.com/ | London, GB