Extenshiextenshi.io/blog
Back to articles
extension-pulsechrome-web-storeprivacyfirefoxw3cbrowser-extensions

Extension Pulse, week of July 20: Chrome Web Store's new privacy rules land August 1

CWS data-minimisation rules enforce August 1. Firefox 153 ships tomorrow. Firefox and Safari just lined up behind COOP/COEP for extension pages.

Maxim Kosterin
4 min read
A hairline document with an orange watercolor seal at the corner — Chrome Web Store privacy rules about to be enforced.
A hairline document with an orange watercolor seal at the corner — Chrome Web Store privacy rules about to be enforced.

Google published new Chrome Web Store Developer Program Policies on July 1. Enforcement is August 1. That's 12 days from this issue, and 31 days from publication, which is not a review cycle. It's a scramble.

The policy post is doing four things at once:

  • Data minimisation. Collection must be "strictly necessary to the extension's disclosed single purpose." Other purposes: prohibited. Not "please don't." Prohibited.
  • Disclosure. Prominent user notification, and you have to tell people if the handling changes after install. A privacy policy you wrote in 2022 and never opened again is not going to survive this.
  • No AI-guardrail bypass. Extensions designed to circumvent safety restrictions on AI services are now an explicit ban. Jailbreak-assistant side panels, this is you.
  • No prediction betting. Real-money predictive-outcome extensions are out.

Non-compliant items get update rejection or takedown. A taken-down listing stays installed but stops updating; Chrome can disable it for policy abuse.

If your extension has an analytics SDK, a "we also improve the product" clause, or a form-fill helper that vacuums extra fields "just in case," this is the week to cut scope or rewrite the disclosure. I walked through how extension privacy policies actually fail users in extension privacy policies and data selling. The new CWS text is that essay with a takedown button attached.

The privacy-policy generator builds a CWS/AMO-shaped policy from the permissions you actually request. Use it as a draft, not as a substitute for reading the new rules.

Firefox 153 ships tomorrow

July 21. ESR series. File-access opt-in. userScripts.execute(), a publicSuffix API, runtime.getDocumentId(), documentId on webNavigation/webRequest, and adoptedStyleSheets for content scripts.

If you maintain a Firefox add-on: test on 153 today, not next month when the ESR freeze makes the API surface a 15-month commitment. The file-access change is the one users will notice; I broke it down in Firefox is about to make file access opt-in.

COOP/COEP is no longer a Chrome-only island

WECG #1039 triaged July 16. Chrome already implemented COOP/COEP on extension pages (since M93). Firefox and Safari both moved to supportive. SharedArrayBuffer in extension pages is now on a cross-browser roadmap instead of a Chromium footnote.

That's the best standards outcome of the week. The OAuth client-metadata proposal (#1038) and the new-tab detection API (tabs.Tab.isNewTab, #1042) are still needs-triage. alarms.create({ name }) has all three vendors supportive; the Chromium CL was still unmerged with the M152 branch a week away.

Calendar, then ignore it

Chrome 157 / 158 / 159 / 160 dates appeared on Chromium Dash (November through January 2027). I am not going to pretend those are stories. They're dates. Come back when a CL with your API in the subject line merges.

August 31 MV2 store removal is still the date that matters. Last week's Pulse has the sequence.

What I'd do this week

Read the CWS policy post once, then grep your extension for analytics, extra-purpose collection, and anything that talks to an AI model on the user's behalf. If you can't point at the single purpose that justifies a field, delete the field.

Update the in-product disclosure before August 1. A policy-only change on a website nobody opens doesn't satisfy "prominent."

Firefox: 153 Beta, file access, ESR freeze. In that order.

Still on MV2? Manifest V3 generator, then @extenshi/cli. August 31 doesn't move.

Sources

Methodology

Signals dated 2026-07-13 through 2026-07-20. Repeat chrome-NNN-release-schedule docs are one calendar note. Catalog MAU on a Firefox-153 row is the Firefox store universe we track (~106k listings), not "99 million users will break."

This issue of Extension Pulse is compiled from vendor docs, WECG triage, and Extenshi catalog snapshots. We don't independently verify every upstream claim. If something here is off, tell us at [email protected].

Last week's Pulse → · Browse the catalog →

Related Articles