Extenshiextenshi.io/blog
Back to articles
extension-pulsechrome-web-storechrome-extensionsfirefoxmicrosoft-edgebrowser-extensions

Extension Pulse, week of August 24: CWS API V1 dies October 15, and Chrome is giving you the Public Suffix List

CWS API V1 dies October 15. Chrome 154 adds chrome.publicSuffix. Edge MV2 and Firefox's two-week train are background.

Maxim Kosterin
4 min read
Nested hairline arcs, the outermost an orange watercolor stroke — the public suffix of a domain.
Nested hairline arcs, the outermost an orange watercolor stroke — the public suffix of a domain.

If your CI still talks to /upload/chromewebstore/v1.1/items, circle October 15, 2026 in a color you reserve for outages.

Google's own CWS API V1 reference now says it in one sentence: V1 is deprecated and supported only until 15 October 2026. No extra grace period on the page. Replacement is CWS API V2 — same OAuth family, different resources, different shapes.

That hits:

  • Studios with a "push to store on tag" pipeline
  • Open-source repos using chrome-webstore-upload or a cousin that still calls V1
  • GitHub Actions that POST a zip at the v1.1 items endpoint

Two months is tight if you ship once a quarter. Audit this week: grep chromewebstore/v1.1 in the repo, bump the uploader, dry-run against a throwaway item. Don't debug this on a Friday in October.

If the pipeline is also the only place you security-scan, put @extenshi/cli in GitHub Actions next to the upload so a V2 migration isn't the week you also discover a permission you didn't mean to ship. Five scans/month free; prepaid packs when CI gets chatty.

chrome.publicSuffix — stop bundling the list

CL 7871095 merged August 18, the day after the M153 branch point, so it lands in Chrome 154 (stable September 22) unless someone cherry-picks. Dave Vandyke's API: ask Chrome for the public suffix of a host instead of shipping your own copy of the Public Suffix List.

Cookie-scope code, storage partitioning, "is this eTLD+1 the same shop as that subdomain" — every blocker and privacy tool that vendors a stale PSL can delete a dependency. The list Chrome uses is the list the cookie jar uses. That's the feature.

Not on developer.chrome.com "what's new" yet. Docs lag a cycle. The CL is merged; the surface is real.

The rest of the frame

Last week was the loud one: Edge started the MV2 phase-out (consumer Stable by end of 2026, enterprise 2027) and Firefox committed to a two-week train from 155. Those don't get re-litigated here. They are now the weather.

Chrome 153 entered beta August 19. Frozen in that train: protocol-handler lifetime, cookies vs site restrictions, UTF-8 URLPattern, splitWithTabId, the user-script privileged-process block. Stable September 8.

Chrome 152 goes full stable tomorrow, August 25. That's the 100-byte setBadgeText cap, the browser namespace is_extension() gate, leftover MV2 pref storage deletion, and alarms.create({ name }). If you didn't test 152 Beta, you are testing it in production tomorrow. Background is in the W31 issue and Chrome 148's browser namespace.

August 31 — six days — is the Chrome Web Store MV2 purge. After that, remaining MV2 listings vanish. Installed copies can linger without updates. The catalog count from June is still the shape of what's left.

What I'd do this week

  1. Grep V1 CWS API. Migrate or schedule the migrate. October 15 is a hard fail, not a warning.
  2. If you ship a PSL, plan the 154 cutover to chrome.publicSuffix. Keep the bundle as a Firefox fallback until they catch up (Firefox 153 already has a publicSuffix API of its own — check you aren't maintaining three lists).
  3. Chrome 152 stable tomorrow: badge length, browser. outside extension contexts.
  4. MV2 on Chrome: you have six days. Manifest V3 generator if you're starting from zero.

Sources

Methodology

Signals dated 2026-08-17 through 2026-08-24. Edge MV2 and Firefox's two-week cycle are covered in depth in the W34 issue and only framed here. Catalog MAU on Chrome 152 rows is the Chrome listing universe (~265k), except the MV2-prefs-removal row (~79k) which is the leftover MV2-adjacent set.

This issue of Extension Pulse is compiled from Chrome Developers docs, Chromium Gerrit, the Edge blog, and Extenshi catalog snapshots. We don't independently verify every upstream claim. If something here is off, tell us at [email protected].

Last week's Pulse → · Browse the catalog →

Related Articles