How to Avoid Google's 'Purple Potassium' Chrome Extension Rejection for Excess Permissions
Chrome Web Store rejections tagged 'Purple Potassium' occur when a submitted extension declares permissions in its manifest that are unused or overly broad in its actual code. Common causes include leftover API permissions from removed features, excessively wide host access patterns, and a misunderstanding of what the 'tabs' permission actually grants. Developers are advised to audit every entry in their permissions, optional_permissions, and host_permissions fields, removing any that lack a corresponding chrome API call and narrowing broad host patterns to specific domains. Writing plain-language notes for reviewers explaining each sensitive permission can also reduce back-and-forth during the review process. A free, open-source CLI tool called tabsmith-lint has been released to automate this static analysis before submission, flagging unused permissions and broad host access automatically.
This is an AI-generated summary. ShortSingh links to the original source for the complete article.
Discussion (0)
Log in to join the discussion and vote.
Log in