gcm

For new extensions you have a few options. chrome.gcm is still the only built-in extension push channel; the alternatives below trade away true server push for simplicity:

1. chrome.gcm — best fit when you need real push (low-latency, server-initiated) without keeping a connection open.
2. WebSockets — the service worker can keep a connection open while it has work to do, but Chrome aggressively shuts down idle service workers, so long-lived sockets are awkward to maintain.
3. Polling with chrome.alarms — periodic fetch from a chrome.alarms listener. Simple, but not real-time.

Use gcm for extensions that need timely server-initiated updates without holding a connection open.

Examples:

• A chat extension that surfaces a notification for new messages.
• A sync extension that needs to invalidate local caches when remote data changes.
• A monitoring extension that pushes alerts when a watched condition fires.

{
  "name": "My GCM Extension",
  "version": "1.0",
  "manifest_version": 3,
  "permissions": [
    "gcm",
    "notifications"
  ],
  "background": {
    "service_worker": "background.js"
  }
}

Why is it low risk?

The permission only lets the extension receive messages from servers it has registered with. It doesn't expose user data to the server beyond whatever the extension explicitly sends; the registration token itself is opaque and tied to the user's specific Chrome install of this extension.

The risk is mostly indirect: an attacker who steals the registration token from your backend can spam the user with push notifications until the user removes the extension or you rotate the token.

// background.js

// Register on install. Use your FCM project's sender ID.
chrome.runtime.onInstalled.addListener(() => {
  chrome.gcm.register(['1234567890'], (registrationId) => {
    if (chrome.runtime.lastError) {
      console.error('GCM registration failed:', chrome.runtime.lastError.message);
      return;
    }
    console.log('GCM registration ID:', registrationId);
    // Send registrationId to your server so it can target this client.
  });
});

// Receive incoming push messages.
chrome.gcm.onMessage.addListener((message) => {
  console.log('Push message received:', message.data);
  chrome.notifications.create({
    type: 'basic',
    iconUrl: 'icon.png',
    title: 'New message',
    message: message.data?.body ?? '(no body)'
  });
});

// Optional: surface send errors (e.g., quota or auth issues).
chrome.gcm.onSendError.addListener((error) => {
  console.error('GCM send error:', error);
});