manifest v3 and required host_permissions not changeable

[snowliver]

Hi All, how to set the required host_permissions for an extension and lock them via a policies.json file?
As written in the Manifest v3 migration guide , host_permissions are treated as optional, and can be disabled, even for a force_installed extension. Any way around that?

Thanks in advance!

[mkaply]

Has Google added this to any of their policy yet?

We were waiting to see what they were doing with optional permissions.

[snowliver]

Let's see.

According to https://developer.chrome.com/docs/extensions/develop/concepts/declare-permissions, chrome separates between host_permissions and optional_host_permissions in their manifest v3. And this is what we see in Chrome and Edge and our extension: no toggle switch available. So obviously Chrome doesn't even have the need for such policy. But Firefox's Manifest v3 doesn't have that separation, and basically only offers optional_host_permissions even if they are activated on installation.

So policy-wise, i guess it would be nice for an enterprise to be in control of different extension settings which are in fact controlled by the browser / user, not the extension. And using BlockAboutAddons seems a bit overkill.

Hm...

"... create manifest v2 extension... "
-- https://bugzilla.mozilla.org/show_bug.cgi?id=1826112#c1

Is this still the way to go??

Thanks in advance.

[mkaply]

So in Firefox 127, host_permissions aren't optional at least initially.

https://bugzilla.mozilla.org/show_bug.cgi?id=1889402

Does Chrome prevent enterprise extensions from overriding them?

[mkaply]

When I install an addon with host_permissions set to :///* in Chrome, I see

in the extension settings.

Does this not appear if an extension is force_installed?

[snowliver]

No, not available via the Extension settings, and it's a manifest v3 extension.

Chrome 125 (sorry for the german setup) , but we're looking on the "Alle deine Daten auf Allen Webseiten lesen und ändern":

Edge 125 Looking on "Alle Ihre Daten auf allen Webseiten lesen und ändern":

Both force_installed via registrykeys in HKLM:SOFTWARE\Policies\Microsoft\Edge\ExtensionInstallForcelist / HKLM:Software\Policies\Google\Chrome\ExtensionInstallForcelist.

[mkaply]

Interesting. But if you install them regular, I assume you do see it?

I wasn't aware of this.

[snowliver]

yes, manually installed, the switch ("Für Zuriff fregegebene Webseiten") is available (here on edge):

[mkaply]

I've opened

https://bugzilla.mozilla.org/show_bug.cgi?id=1904054

for this since this would be fixed in Firefox.

[snowliver]

Thanks @mkaply !