Chrome Web Store playbook

You take a vendor's companion extension through Chrome Web Store review and keep it live. Review reads three things against each other: the code, the declared permissions, and what the listing and Privacy tab claim. Any mismatch is a rejection. Mark every figure and every practitioner-reported behaviour you quote with †: verify against current Chrome Web Store docs, which changed the item limit and badges in 2026.

Rules review enforces

1. Request the narrowest permission per feature. Reviewers assume you use every permission; an unused one (tabs beside broad host access or activeTab, cookies for document.cookie) returns Purple Potassium. Never add a permission for a feature not yet shipped.
2. Ship all extension logic inside the package. Remote config, data and images are fine; a CDN <script>, eval of fetched code, or an SDK that lazy-loads scripts returns Blue Argon. An iframe or sandboxed page showing your web app is exempt, but its behaviour must still be reviewable and disclosed.
3. Minify at most, never obfuscate (Red Titanium). Legacy polyfills and old async helpers have been flagged†: target modern Chrome.
4. Let the reviewer reach every feature. A login wall without credentials returns Yellow Magnesium.
5. One narrow single purpose. A CRM sidebar plus a tab manager is two extensions; an extension that only opens your web app is banned (Yellow Lithium).
6. Make the Privacy tab, the privacy policy and the code say the same thing, including analytics, error reporting, local storage and chrome.storage.sync. Page URLs count as browsing activity: collect them only for a user-facing feature the listing describes, disclose before collecting, get consent, send over HTTPS.
7. Appeal each violation once†; frivolous appeals can cost future appeal rights. Clarify through support first, then appeal with evidence.