Manifest V3

Secure a Chrome Browser Extension

A browser extension operates in a hostile client environment. Keep authority short-lived, isolate it from page scripts, use Manifest V3 controls, and move sensitive policy and secrets to the backend.

Integration path

Start HereRegister extension ID, owners, environments, allowed origins, and enterprise policies.Open →Test ModeUse isolated users, origins, devices, and policies.Open →Developer ToolsDownload shared test assets.Open →Quick StartValidate the protected backend before the extension UI.Open →

Required controls

Manifest V3Service worker, least permissions, and strict content security policy.Open →Session authorityShort-lived tokens stored only for the active session.Open →WebCrypto keyNon-exportable private key held in IndexedDB-backed browser storage.Open →Enterprise policyManaged deployment, allowlists, update control, and incident removal.Open →

Implementation steps

Minimize host and API permissions; do not use wildcard access without a reviewed business requirement.

Keep access tokens session-scoped and unavailable to injected page scripts.

Generate a non-exportable WebCrypto key and register the public key.

Route privileged actions through the background service worker and backend policy service.

Test hostile pages, message spoofing, extension reload, browser sync, managed policy, revocation, and forced update.

Control details

Mv3

Use Manifest V3, strict extension pages, a minimal service worker, and no remotely hosted executable code.

Session

Store only bounded session authority. Avoid persistent bearer tokens in local or sync storage.

Webcrypto

Generate a non-exportable signing key and bind signed requests to nonce, origin, audience, and session.

Policy

Enterprise deployment should use managed allowlists, policy templates, update control, and rapid disablement.

Chrome Manifest V3

Keep privileged authority outside page scripts

manifest.json

{
  "manifest_version": 3,
  "name": "B5 Secure Enterprise Extension Sample",
  "version": "0.1.0",
  "permissions": [
    "storage",
    "identity"
  ],
  "host_permissions": [
    "https://YOUR-ASSIGNED-TEST-ENDPOINT/*"
  ],
  "background": {
    "service_worker": "service-worker.js",
    "type": "module"
  },
  "action": {
    "default_title": "B5 Secure"
  },
  "content_security_policy": {
    "extension_pages": "script-src 'self'; object-src 'none'"
  }
}

MV3Chrome extension sampleManifest V3 and service-worker sample.Download ↓

Use exact host permissions.
Keep tokens session-scoped.
Generate a non-exportable WebCrypto key.
Route privileged work through the extension service worker and backend.
Test hostile-page messages, forced update, managed policy, and revocation.

Developer Relations

Talk to a human.

Get architecture guidance, Test Mode access, integration review, or help choosing the right B5 identity and authorization pattern.

Contact Developer Relations Request a demo