PSA: Restricting unpacked extensions to developer mode

[Oliver Dunk]

Hi all,

Starting in Chrome 133, unpacked extensions loaded from the chrome://extensions page will only be enabled if the developer mode switch is turned on. When the switch is turned off, these extensions will be disabled.

We are making this change as part of our continued effort to keep Chrome safe for users.

This does not affect extensions loaded on the command line with the –load-extension flag.

We don't expect this to have a significant impact for developers, but welcome feedback here in the mailing list.

Thanks,
Oliver on behalf of Chrome Extensions DevRel

[woxxom]

As some extension developers suggested about a year ago when chrome.userScripts API was restricted to dev mode, Chrome should indicate that dev mode is active somehow in its UI to ensure that users are aware they enabled a potentially dangerous option. Your team never responded to this suggestion or any others made back then.

[woxxom]

To clarify, the idea for the indicator was that it should be global, i.e. visible at all times, not just when visiting an arcane chrome://extensions page with an innocuously looking little cute knob in the corner that enables an avalanche of seemingly unrelated changes in behavior.

[woxxom]

For example, change the icon of the extensions menu somehow, invert it, encircle it, or show an "under construction" icon instead or inside of the puzzle piece.

[Richard Chen]

Hi all, unpacked extensions will be restricted starting in Chrome 134 instead.

Thanks,

Richard

[xmcp]

Since the userScripts API requires the developer mode to function, I could imagine developers testing the corner case behavior of their extensions (e.g., error reporting when the userScripts API is unavailable) by toggling this mode. After this change, they can no longer test their unpacked extensions (because turning off the developer mode also turns off the extension). Now the developers have to self-sign their extensions and make a force installation for this testing purpose. Is that correct?

[woxxom]

Chromium will soon have an explicit mechanism of enabling the userScripts permission judging by https://crbug.com/390138269

[Oliver Dunk]

Thanks for calling this out - it's a completely fair point.

As wOxxOm mentioned, we're still working on the feedback around the developer mode requirement so hopefully this will be easier again soon.

In the meantime, you're right that you would need to package an extension. You don't need to force install the extension, but depending on the operating system you may need to set policy in order to be able to load a CRX file. One way of doing this is with the Extension Update Testing Tool which adds the extension to the ExtensionInstallAllowlist: https://github.com/GoogleChromeLabs/extension-update-testing-tool

Oliver Dunk | DevRel, Chrome Extensions | https://developer.chrome.com/ | London, GB