Halloween DealsAmazon USHalloween week deals: useful picks before month-endAmazon US: current deals, useful picks and tech finds.Check DealsWindows FixRecommendedWindows errors stealing your time? Find the fix fastScan stability, cleanup and performance issues.Fix NowHalloween DealsAmazon USOctober picks are moving - compare before checkoutAmazon US: current deals, useful picks and tech finds.See Picks×
Skip to content
World desk5 min

How to Build a Chrome Extension with Manifest V3, Step by Step

A practical guide to planning a Chrome extension, building its Manifest V3 structure, choosing permissions, handling data, testing, and preparing for publication.
Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

To build a modern Chrome extension, start with one clearly defined user task, choose the smallest set of extension components that can perform it, and declare those components in a root-level manifest.json. Manifest V3 extensions use an event-driven service worker for background events, bundle their executable code, and request only the permissions their features need. Then test the complete user flow and prepare accurate privacy disclosures before submitting to the Chrome Web Store.

Plan the task and choose the extension surface

Define the action your extension performs and when the user expects to perform it. Chrome extensions are assembled from components that can be combined as needed, rather than from one required interface. A toolbar popup suits a brief interaction; a side panel can support a more persistent workflow; a context menu fits an action tied to a selected page or item; and a content script is appropriate when the feature must interact with a webpage. See Chrome’s extension development overview for the available platform building blocks.

As an Amazon Associate I earn from qualifying purchases.

Map each feature to where it should run before adding manifest entries. Page-specific work belongs in a content script; background events and coordination belong in the extension service worker. A popup or other extension page can provide the user interface. This keeps access and code aligned with the task instead of granting broad capabilities speculatively.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Create the Manifest V3 manifest

Place manifest.json at the extension package root. Chrome requires the manifest_version, name, and version keys; for manifest_version, the Chrome for Developers Manifest file format says, “The only supported value is 3.” Add optional keys only when your implementation uses them.

{
  "manifest_version": 3,
  "name": "Example extension",
  "version": "1.0",
  "description": "A short, accurate description of the extension",
  "permissions": ["storage"],
  "background": {
    "service_worker": "service-worker.js"
  },
  "action": {
    "default_popup": "popup.html"
  }
}

This is a structural example, not a complete extension. The storage permission, worker, and popup are optional choices: remove any that the extension does not use. A popup-only extension may not need a background worker. Add content-script declarations or host permissions only when the feature requires page access.

Put each job in the right execution context

Content scripts: work with webpage content

Content scripts run in web pages and can read or change the page DOM. Use them for the part of a feature that must inspect or modify a site. They can communicate with extension components, including the service worker, through messaging; keep unrelated background coordination out of the page script.

Rank #2
Sale
HTML and CSS: Design and Build Websites
  • HTML CSS Design and Build Web Sites
  • Comes with secure packaging
  • It can be a gift option

Service worker: respond to background events

In Manifest V3, the extension service worker handles background events and coordinates work with content scripts and extension pages. It does not have DOM access. Design background logic around events and messaging rather than relying on a continuously running page or persistent in-memory state. If a task requires DOM APIs but should not open a user-facing window, Chrome’s migration guidance describes using an offscreen document.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Keep executable code in the package

Manifest V3 disallows remotely hosted executable code. Include the extension’s executable code in the reviewed extension package rather than downloading code to run later. Network requests can still be part of a feature where appropriate, but they do not make remote executable code permissible. Consult Chrome’s Manifest V3 migration overview when evaluating changes to an older extension.

Request only the access each feature needs

Permissions describe capabilities and access; they are not a substitute for privacy-conscious design or a guarantee of Chrome Web Store approval. Start with the APIs and sites the feature needs now, and avoid requesting access “just in case.” Chrome’s permission guidance explains permission declarations and access choices.

Approach When it fits Access pattern
activeTab A user-invoked action that needs temporary access to the current tab Access is granted when the user invokes the extension and ends when they navigate away or close the tab
Optional permissions A nonessential feature that users can choose to enable when they need it Request access at the time the user chooses that feature, and explain why it is needed
Host permissions A feature that genuinely needs access to specified sites Declare only the site access required by the functionality

For any permission request, explain its purpose in the interface at the point access is requested. A minimal manifest helps limit exposure, but the extension’s actual collection, use, sharing, and retention practices must also match its privacy disclosures.

Rank #4
Sale
Web Design with HTML, CSS, JavaScript and jQuery Set
  • Brand: Wiley
  • Set of 2 Volumes
  • A handy two-book set that uniquely combines related technologies Highly visual format and accessible language makes these books highly effective learning tools Perfect for beginning web designers and front-end developers

Handle data and network behavior deliberately

Minimize collection and storage

Collect only the data needed for the feature. Chrome’s user privacy guidance says extension storage is not encrypted, so do not use it as a secure vault for sensitive user data. If data must be transmitted or stored remotely, use HTTPS and an appropriately secured server. Decide explicitly what the extension does in incognito windows, and avoid retaining browsing history from incognito sessions.

Free tools Windows power users keep installed

One-click scans. No signup required.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Choose the network API to match the job

If the extension filters or modifies network requests, assess whether declarativeNetRequest supports the required rules. It is a potential replacement for many use cases that previously used blocking webRequest listeners, but the right choice depends on the behavior the extension needs. Review Chrome’s migration guide and the API requirements for the specific use case before selecting an implementation.

Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Support on Ko-Fi

Test the user journey before publication

Test the extension end to end, from installation and permission prompts through its main task and any recovery paths. Chrome’s extension best practices recommend manual coverage across browser versions, operating systems, and network conditions, as well as accurate privacy disclosures and policy compliance.

  • Check that each interface—such as the popup, side panel, context menu, or page interaction—appears when expected and communicates failures clearly.
  • Exercise service-worker event handling and messaging, including cases where a worker must handle an event without relying on previous in-memory state.
  • Verify the extension’s behavior when the network is slow or unavailable, and when permissions are declined or granted only later.
  • Review data collection, storage, transmission, and incognito behavior against the privacy disclosures users will see.
  • Confirm that the store listing accurately describes the extension’s features and sets appropriate user expectations.

Chrome APIs and Chrome Web Store policies can change. Verify the current API behavior and store requirements for the Chrome version and publication date relevant to your release.

Updating a Manifest V2 extension

A migration is not just a manifest version change. The necessary work depends on the existing extension, so use Chrome’s official migration guide and checklist to identify the changes for your codebase. Review manifest and host-permission declarations, move background behavior to the service-worker model, assess API replacements such as request-rule handling, and remove remotely hosted executable code. Then test the migrated extension and plan its release so users understand any changed permissions or behavior.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.

Leave a Reply

Your email address will not be published. Required fields are marked *

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

More from the Wire

  1. World desk4 min
    How to Spot an AI Voice Scam Before Sending MoneyDon’t rely on how a caller sounds. Pause, call back through a known number, and verify the emergency with another trusted person before sending money.
  2. Mountain View desk4 min
    Google’s SynthID Detector: How to Check AI-Generated Images, Video and AudioGoogle’s SynthID Detector looks for an embedded watermark in supported images, video and audio. Here is what its results do—and do not—show.
  3. Redmond desk20 min
    How to create a link to File or Folder in Windows 11Windows 11 gives you several ways to point to a file or folder without moving or duplicating it. You can create a desktop shortcut,…
Recommended PC Tool
Recommended PC Tool
Crashes, No Sound, or Screen Glitches?Free driver scan
PC Slower Than It Used to Be?Free scan - under a minute

Two free Windows tools

One Free Minute Could Fix That PC

Before you go - each of these free tools takes about a minute and tackles what quietly slows a Windows PC down.

Special offer. View Outbyte info, uninstall instructions, EULA, and Privacy Policy.