unlimitedStorage explained: the extension permission with no ceiling — and the W3C plan to add one

Most extension permissions sound scary. This one sounds boring — which is exactly why nobody thinks about it.

unlimitedStorage. It's a single line in a manifest.json that quietly removes the cap on how much data an extension can stash on your machine. No warning dialog. No "this extension can read and change all your data" popup. It just… turns off the limit.

We run a catalog that reads the manifest of every extension across the Chrome, Firefox, and Edge stores, so I went and counted. 14,386 extensions we track declare unlimitedStorage, and together they reach roughly 687 million monthly users. That's the number to sit with before we get into what it does.

And there's news worth your attention: the standards body that governs the cross-browser extension platform is, as I write this, debating whether to put a ceiling back on. A proposal is on the table at the W3C WebExtensions Community Group, with discussion scheduled to continue on July 2, 2026.

What unlimitedStorage actually is

Extensions store data locally in a few ways — chrome.storage.local, IndexedDB, the Cache API. If you want the fuller picture of the underlying API, I broke it down in what the storage permission actually grants. By default the browser enforces a quota on that storage, the same way it limits how much a website can save. It's a guardrail.

Declaring unlimitedStorage removes that guardrail:

{
  "permissions": ["unlimitedStorage"]
}

With it set, the extension can keep writing to disk effectively without bound — up to whatever free space your drive has. The capability is documented openly on MDN and in Chrome's extension docs. It's not a secret. It's just invisible, because — unlike host permissions or cookies — it triggers no install-time prompt.

What it actually allows

Most of the time, nothing sinister. Plenty of tools have honest reasons to want it.

Offline-first apps. A reading-list or note-taking extension that caches your library so it works on a plane genuinely needs room to grow.

Media and download tools. Anything buffering video, audio, or large files locally would blow through the default quota fast.

Heavy caches. Translation dictionaries, AI assistants caching model output, dev tools storing big traces — all legitimate reasons to ask for headroom.

The permission itself is neutral. The problem is the combination of two things: it has no cap, and it has no prompt. So you have no idle signal that an extension is steadily accumulating data about you on your own disk — browsing snapshots, scraped page content, behavioral logs — and keeping it there indefinitely. Pair unlimitedStorage with broad host permissions and an extension can both read everything you do and never run out of room to remember it.

It's also a quiet denial-of-service vector. An extension that misbehaves — or gets hijacked after an ownership change — can fill your drive until things start failing, with nothing in the UI to point at the culprit.

Why the W3C is stepping in

Here's the forward-looking part. The W3C WebExtensions Community Group — the group where Google, Mozilla, Apple, and Microsoft hash out how extensions behave across browsers — has an open proposal to revisit how unlimited storage works, including whether browsers should expose a real quota and reporting model rather than an all-or-nothing switch (issue #1030). Discussion is set to continue on July 2, 2026.

I want to be careful here: this is a proposal under discussion, not a shipped change, and the exact shape of any limit is still being argued in those threads. Nothing breaks on July 2. But the direction matters. If the group lands on a defined quota or a usage-reporting requirement, extensions that today silently grow forever would eventually need to declare and justify what they store — and you'd get visibility you don't have now.

If you build extensions, this is the moment to read those two issues and weigh in, because the people in the room are deciding the defaults you'll ship under.

A detail from our catalog

One more thing the data shows. Of those 14,386 extensions requesting unlimitedStorage, 2,055 — about 21.7 million users' worth — have already been pulled from their stores. Removal doesn't retroactively wipe what a now-delisted extension wrote to your disk while it was installed. If you ever ran one of those, the data it cached may still be sitting in your profile.

How to check your own extensions

You don't need to read anyone's source code.

1. Open chrome://extensions (or about:addons in Firefox), hit "Details" on each one, and ask the honest question: does a toolbar tweak really need offline storage? A note app, sure. A theme switcher, no.

2. Look at disk usage. In Chrome, chrome://settings/content/all lets you see on-device data by origin, including extensions. A small utility holding hundreds of megabytes is a flag worth pulling.

3. Search the Extenshi catalog for anything you're unsure about — we show the full declared permission set next to the extension's category, so you can judge whether unlimitedStorage matches what the thing actually does.

4. Remove what you don't use. A dormant extension keeps its storage and its permissions. Deleting it clears both.

FAQ

Does the unlimitedStorage permission show a warning? No — and that's the whole problem. Unlike host permissions or cookies, unlimitedStorage triggers no install-time prompt. An extension can declare it and you'd never see a dialog. You only find it by reading the manifest or checking a catalog.

Is the unlimitedStorage permission dangerous? On its own, no — plenty of offline-first and media tools have honest reasons to want it. It gets risky in combination: paired with broad host access, an extension can both read what you do and keep an uncapped record of it on your disk indefinitely, with no UI signal to warn you.

How do I see which extensions use unlimitedStorage in Chrome? Chrome's chrome://extensions details page doesn't spell it out, and there's no permission prompt to catch. Check on-device data by origin at chrome://settings/content/all, or search the extension in a catalog that surfaces the full declared permission set.

unlimitedStorage is the rare permission that's powerful precisely because it's quiet. It won't ever interrupt your day with a warning — which is exactly why it's worth a deliberate look before the standards bodies decide its future for you.

Check your permissions now →

This article is based on publicly available standards discussions and our own catalog data. Extenshi does not independently verify all claims made by third-party sources, and the W3C proposal referenced here is an open discussion, not a finalized change. References to specific companies or products do not constitute accusations of intentional wrongdoing. If you believe any information is inaccurate, please contact us at [email protected].