How the Chrome extension rejection checker works

Read severity as triage priority, not final policy judgment

The scanner assigns severity to help prioritize review. High means the package contains a strong static signal, such as a remote executable loader, unsafe extension-pages CSP value, missing root manifest, or broken manifest reference. Medium and Low findings often mean manual review is needed. They are not automatic policy violations, and a clean scan is not an approval guarantee.

• •High: fix first and rescan.
• •Medium: review against official docs and project context.
• •Low: document, confirm, or ignore only after manual review.

Understand what static scanning cannot see

A local static scan cannot execute the extension, inspect Chrome Web Store dashboard fields, verify server responses, detect every obfuscated behavior, or decide whether reviewers will accept a disclosure. It is strongest at package-level checks that are visible in the submitted files. Use it before manual review, not instead of manual review.

• •Best at: manifest, CSP, referenced files, static JS/HTML patterns, scan limits.
• •Not enough for: runtime behavior, server-side responses, policy intent, final approval.
• •Use official Chrome docs as the final reference for each rule family.

How rules are grouped in the report

The report separates package findings from scan-limit notes. Findings describe detected code, manifest, CSP, permission, or privacy signals. Scan limits describe files that were skipped, size limits, unknown ZIP metadata, or partial-scan boundaries. This separation matters because a scan limit is not a policy violation; it tells you where manual inspection may still be needed.

• •High findings usually deserve a package change before resubmission.
• •Medium findings usually deserve manual confirmation or reviewer-note preparation.
• •Scan limits should trigger targeted manual inspection of skipped files.

Why confidence labels appear beside findings

Static scanning cannot understand every runtime path or reviewer decision. Confidence labels help separate high-confidence loader patterns from manual-review signals and possible non-runtime contexts. For example, a remote script URL assigned to a script loader is stronger than the same URL appearing inside documentation text or a source map comment.

• •Use high-confidence findings as direct repair targets.
• •Use manual-review findings to decide whether a signal is data, documentation, or executable code.
• •Remove noisy source maps or comments from release packages when they create review ambiguity.

How official documentation maps to scanner checks

The scanner does not invent policy categories. Its rules map to public Chrome documentation: remote hosted code guidance, MV3 content security policy rules, sandbox rules, ZIP packaging guidance, permissions guidance, and privacy-practices documentation. The implementation still remains a static helper, so official docs and the Developer Dashboard remain the final reference for submission decisions.

• •Use source links to verify the rule family behind a finding.
• •Expect some findings to be conservative because static scanners prefer review prompts over silence.
• •Update scanner wording whenever Chrome documentation changes.

Why scan the production ZIP?

Build tools can change paths, bundle dependencies, and generate files. Chrome Web Store reviews the submitted ZIP, so scan that final artifact.

Why are some findings not automatic violations?

Some permissions and remote URLs are context-dependent. The scanner flags them so you can review purpose, disclosure, and implementation.

How often should rules be reviewed?

Review scanner rules whenever Chrome extension policies or Manifest V3 guidance changes, and record the last reviewed date in the changelog or documentation.

Which official docs does the scanner map to?

The core rules map to Chrome documentation for remote hosted code, Manifest V3 CSP, sandbox pages, ZIP packaging, privacy practices, and permission policies. The scanner shows these sources so each finding can be reviewed against the source of truth.