Today, content scripts can request access to any origin, including origins that aren't allowed by the website. To improve transparency, the Microsoft Edge extensions team provides controls that enable users to allow or restrict access to websites at runtime. These permissions allow extensions to operate with minimum intervention, and so present a risk for user privacy and security. Run-time host permissionsĪt installation time, it's possible for extensions to request blanket permissions to access all sites and content. Alternatively, you can use the eval() function in a sandboxed environment.

This change makes extensions more secure.ĭevelopers will need to package and submit all code that is used by the extension, for validation. To ensure that Microsoft Edge Add-ons lists validated extensions, the Microsoft Edge extensions team disallows extensions from using remotely hosted code. While this offers flexibility to change code without resubmitting the extension to the store, it's possible to exploit the code after installation. Today, some parts of the extensions code are hosted remotely, and aren't included as part of the extension package during the validation process. For guidance on migrating your extension to Manifest V3, see Overview of Manifest V3 - Chrome Developers.

This article lists important changes being implemented as part of Manifest V3, which is the next version of the Chromium Extensions platform.

Developing microsoft edge extensions