Skip to content
Lioncore
8 min read

Publishing a Chrome extension in 2026: what changed

My notes after several Manifest V3 releases: project structure, Chrome Web Store submission and review timelines.

chromeextensionmanifest-v3

Why it's still worth it in 2026

The Chrome Web Store remains the most cost-effective channel to distribute a productivity tool. No App Store to navigate, no required backend, and hundreds of millions of users in reach. Install friction is low, updates are automatic.

The flip side: Manifest V3 cleaned up the API, so several things that worked in V2 don't anymore. And Google's manual review has tightened around permissions.

The structure I use now

For an extension that needs a service worker, popup and content script:

src/
  manifest.ts
  background/
    index.ts
  popup/
    index.html
    main.tsx
  content/
    inject.ts

I generate manifest.json from TypeScript to get autocompletion on permissions and an auto-incrementing version hash. The bundler (Vite + crxjs) outputs the final ZIP.

The service worker trap

In V3, the background isn't persistent. The service worker can be killed after 30 seconds of inactivity. All in-memory variables disappear.

  • Don't use setInterval for recurring tasks: the worker may be dead. Use chrome.alarms.
  • Store all state in chrome.storage or IndexedDB.
  • Prefer listeners (onMessage, onInstalled) to polling.

Submission

  1. Developer account: USD 5 one-time
  2. ZIP of dist/, 1280×800 screenshots, 128×128 icon
  3. Short description (132 chars max), long description (HTML allowed)
  4. Privacy policy mandatory as soon as you touch user data
  5. Clear justification for every permission

Current review delay: 2-5 days for first submission, 12-24h for minor updates.

Rejections I've seen

  • Single purpose violated: your extension does too much
  • Too-broad permissions: <all_urls> no longer accepted without explicit justification
  • Missing privacy policy when the extension sends data
  • Obfuscated code: forbidden. Minification is fine, obfuscation isn't.

Conclusion

The ecosystem is mature and stable. Respect single purpose, justify permissions, provide a clear privacy policy and submission goes smoothly.