How to build a Chrome extension that passes store review

A Chrome extension is built for store review when it asks for the fewest permissions its single purpose needs, ships no remote code, explains every permission in plain words, and comes with a listing and images that match what it really does. We built two extensions to that standard, Tablenapper and Fluffcutter. This post covers the permissions, the headless tests, the store assets and how we handle paid features.

What does Chrome Web Store review check?

Chrome Web Store review checks that an extension does one clear thing, asks only for the permissions that purpose needs, runs no code fetched from elsewhere, handles user data as its privacy disclosures say, and that the listing describes the product honestly. We designed for those five points before writing a single feature.

Google sets the rules out in its program policies, and Manifest V3 is the platform new extensions are built on. Under V3, remotely hosted code is not allowed, so the reviewer sees everything the extension will ever run.

Our two extensions each do one job. Tablenapper copies any web table to Excel, CSV or Markdown. Fluffcutter cuts the ads, menus and pop-ups from an article so you can print it or save a clean PDF. A single sentence describes each one, which made the single-purpose question easy to answer.

Which permissions does a Chrome extension actually need?

A Chrome extension needs only the permissions its single purpose uses at the moment the user acts. Both of ours run on three: activeTab, which grants access to the current tab only after the user clicks the toolbar button, scripting to run code in that tab, and storage to remember settings. Neither requests access to every website.

Google's activeTab documentation explains why this permission avoids the broad host warning at install. Tablenapper has no content scripts and no background worker at all. A test reads the manifest and fails if the permission list ever grows. Another test proves activeTab is the only way in: before the button is pressed, an attempt to run code in the page is refused.

The store listing then explains each permission in one plain line, in the same words a reviewer reads.

How do you test a Chrome extension headlessly?

You test a Chrome extension headlessly by loading the unpacked extension into a Playwright-driven Chromium and driving it like a user. Headless Chrome has no toolbar, so our harness presses the extension's button through the DevTools protocol, which grants activeTab exactly as a real click would, then opens the popup as a page.

Tablenapper has 18 tests and Fluffcutter has 10. They cover what a reviewer and a buyer would both try.

• Exact output. Copied tables and CSV files are compared byte for byte, including the byte order mark that keeps accents intact in Excel.
• No row cap. A 1,000-row fixture must come out with every row.
• Free features stay offline. Free actions make no network calls at all.
• Paid gates. An invalid key stays locked, a valid key turns Pro on, and a revoked key drops back after the weekly check.
• Policy checks in code. A test scans every file for URLs outside an allow list and for eval or new Function.
• A real site. One test runs against a live Wikipedia page, because fixtures never cover everything.

We run every browser job headless as a rule. The same approach powers how we measure what AI assistants say about a brand.

What images does a Chrome Web Store listing need?

A Chrome Web Store listing needs a 128 pixel icon, at least one screenshot at 1280 by 800 or 640 by 400 pixels, and optionally a 440 by 280 small promo tile and a 1400 by 560 marquee. Google's guide asks for 96 pixels of icon artwork inside 16 pixels of transparent padding, which our first icons missed.

The full spec is in Google's image guidelines. We generate every image from code. A Python script renders the icons and the five full-bleed screenshots, so a UI change means re-running a script, not redrawing slides by hand. A silent 24-second promo video is rendered from code too.

Before submission, both listings went through our design review gate, which scored the screens and store images from headless screenshots. That review changed things a reviewer would also care about.

• No borrowed trade dress. A screenshot that imitated a spreadsheet app's ribbon was redrawn in neutral chrome.
• No promises you cannot audit. "Free forever" became "free with no row cap".
• Readable contrast. Buttons and promo tiles were darkened until white text passed WCAG AA.
• No leaked test details. A local test server address that showed up in a screenshot was replaced.

How do you handle paid features in review?

Paid features can only be reviewed when the reviewer can test them without paying, and the price model should be stated plainly. Our extensions sell a one-time Pro licence, checked against our backend at most once a week, and we create a free reviewer key that goes in the store's test instructions, then revoke it after review.

The licence service lives on the same shared backend as our other paid products, with its own records instead of shared accounts. Extension origins may call only the licence endpoints, never the rest of the API, so an installed extension cannot reach any other product. The payment flow follows the lessons in what breaks when you ship a product with payments.

Each extension also has its own small site, served from Cloudflare like the setup in running products on Cloudflare. The store button on each site reads "Coming soon" until the listing is live, and pointing it at the real listing is a one-line change.

Frequently asked questions

Build it as if the reviewer is reading over your shoulder

A clean review is a side effect of a clean product: one purpose, few permissions, tested output and an honest listing. That same discipline is what makes the extension worth installing. Nactore is a technology and growth company that builds, ships, ranks and grows products end to end, measured on your growth. See more of what we have shipped on our work page.

Have an extension or product idea? Book a free 30-minute call and we will tell you what we would build first.