management

This is a highly specialized permission, typically used for extension manager utilities or for extensions that work together as a suite.

Examples:

• An "extension manager" that provides a custom UI for enabling/disabling other extensions.
• A "profiles" extension that enables or disables sets of extensions based on the user's current task (e.g., "Work" vs. "Social" mode).
• An extension from a company that wants to check if a companion extension is also installed.

This permission triggers a warning on installation.

{
  "name": "My Extension Manager",
  "version": "1.0",
  "manifest_version": 3,
  "permissions": [
    "management"
  ]
}

Why is it risky?

This permission lets an extension see all other extensions you have installed, and more importantly, disable them.

A legitimate extension manager might use this to help you organize your extensions. However, a malicious one could use this power to turn off your other security extensions, such as your ad blocker or antivirus extension, leaving you vulnerable to attacks. It cannot install or uninstall other extensions without your permission, but disabling them can be risky enough.

This example gets a list of all installed extensions and logs any that are currently disabled.

// popup.js or background.js

async function findDisabledExtensions() {
  try {
    const extensions = await chrome.management.getAll();
    const disabledExtensions = extensions.filter(ext => !ext.enabled);

    if (disabledExtensions.length > 0) {
      console.log('Found disabled extensions:');
      disabledExtensions.forEach(ext => {
        console.log(`- ${ext.name} (ID: ${ext.id})`);
      });
    } else {
      console.log('All extensions are currently enabled.');
    }
  } catch (error) {
    console.error('Error getting extensions:', error);
  }
}

findDisabledExtensions();