Chrome Extension Content Script on https://chrome.google.com/webstore/

by

TL;DR The webstore cannot be scripted by extensions, and the flag that previously allowed you to do that (--allow-scripting-gallery) has been removed in Chrome 35.

Chrome extensions cannot execute Content scripts / insert CSS the Chrome Web Store. This is explicitly defined in the source code, at function IsScriptableURL (click on the previous link to see the full logic).

  // The gallery is special-cased as a restricted URL for scripting to prevent
  // access to special JS bindings we expose to the gallery (and avoid things
  // like extensions removing the "report abuse" link).
  // TODO(erikkay): This seems like the wrong test.  Shouldn't we we testing
  // against the store app extent?
  GURL store_url(extension_urls::GetWebstoreLaunchURL());
  if (url.host() == store_url.host()) {
    if (error)
      *error = manifest_errors::kCannotScriptGallery;
    return false;
  }

manifest_errors::kCannotScriptGallery is defined here:

const char kCannotScriptGallery[] =
    "The extensions gallery cannot be scripted.";

The error can be viewed in the background page’s console when you use chrome.tabs.executeScript to inject a script in a Web Store tab. For instance, open https://chrome.google.com/webstore/, then execute the following script in the background page of an extension (via the console, for live debugging):

chrome.tabs.query({url:'https://chrome.google.com/webstore/*'}, function(result) {
    if (result.length) chrome.tabs.executeScript(result[0].id, {code:'alert(0)'});
});

More Related Contents:

  1. How to access the webpage DOM rather than the extension page DOM?
  2. How can I get the URL of the current tab from a Google Chrome extension?
  3. How to stop CORB from blocking requests to data resources that respond with CORS headers?
  4. How can I open my extension’s pop-up with JavaScript?
  5. Since v38, Chrome extension cannot load from HTTP URLs anymore, workaround?
  6. Start an external application from a Google Chrome Extension?
  7. Chrome Extension: how to capture selected text and send to a web service
  8. Where does Chrome store extensions?
  9. How can I get the current tab URL for chrome extension?
  10. Content script matching top-level domains like all google.*
  11. How can I enable my chrome extension in incognito mode?
  12. Insert an image in chrome extension
  13. How to disable (gray out) page action for Chrome extension?
  14. Inject HTML into a page from a content script
  15. chrome.identity User Authentication in a Chrome Extension
  16. Can I modify outgoing request headers with a Chrome Extension?
  17. Is it possible to inject a javascript code that OVERRIDES the one existing in a DOM? (e.g default alert function)
  18. How do I import scripts into a service worker using Chrome extension manifest version 3?
  19. Cross-origin request in a content script is blocked by CORB despite the correct CORS headers
  20. Add contextmenu items to a Chrome extension’s browser action button
  21. How to make a cross-origin request in a content script (currently blocked by CORB despite the correct CORS headers)?
  22. Google Chrome Extensions – Open New Tab when clicking a toolbar icon
  23. Chrome version 18+: How to allow inline scripting with a Content Security Policy?
  24. What does “http://*/*”, “https://*/*” and “” mean in the context of Chrome extension’s permissions
  25. CORS issue doesn’t occur when using POSTMAN
  26. How can I detect the current tab’s mime type in a Google Chrome extension?
  27. Run script each time Chrome extension icon clicked
  28. Chrome Console SameSite Cookie Attribute Warning
  29. Passing message from background.js to popup.js
  30. Accessing `window`/DOM/HTML of the webpage from the extension

Leave a Comment