Modifying the built-in newtab page

by

The problem is that Chrome 61 and newer explicitly forbids access to the contents of its built-in new tab page (NTP) via content scripts or any other API.

The solution is to create the entire replacement page as an html file in your extension and specify it in chrome_url_overrides.

As for why, here’s quoting [source] rdevlin, one of the developers of chrome extensions API:

There’s a few reasons for this change. One is to enforce policy,
the other is for consistency.

  • We’ve had a public policy for awhile now that states that modification of
    the NTP through anything other than Chrome URL overrides isn’t allowed (though
    we didn’t begin enforcing this policy in many cases until July 1st). This is
    merely bringing chrome code more inline with that same policy to help prevent
    surprise if an extension is modifying the NTP and is taken down for policy
    violations.
  • This is also for consistency, since we’ve actually treated scripts on the NTP
    differently for years now, due to certain NTP magic. For example, the URL seen
    by the browser on the NTP is chrome://newtab, but the url in the renderer is
    https://www.google.com/_/chrome/newtab. Since chrome.tabs.executeScript checks
    the URL in the browser, the script would be denied, even though content scripts
    (checked in the renderer) would be allowed. In theory, these permissions should
    not be different. Similarly odd, if the user is using the local ntp
    (chrome-search://local-ntp/local-ntp.html), injection would already be
    disallowed in both the renderer and the browser. And, if we go waaaaay back,
    the NTP used to be pure WebUI with an URL of chrome://newtab, where injections
    were again disallowed. Rather than have inconsistent behavior depending on the
    type of script injection the extension uses, we want to have consistency
    throughout the system.

P.S. Please don’t edit the quoted text.

More Related Contents:

  1. How to access the webpage DOM rather than the extension page DOM?
  2. How can I get the URL of the current tab from a Google Chrome extension?
  3. How to stop CORB from blocking requests to data resources that respond with CORS headers?
  4. How can I open my extension’s pop-up with JavaScript?
  5. Since v38, Chrome extension cannot load from HTTP URLs anymore, workaround?
  6. Start an external application from a Google Chrome Extension?
  7. Chrome Extension Content Script on https://chrome.google.com/webstore/
  8. Chrome Extension: how to capture selected text and send to a web service
  9. Where does Chrome store extensions?
  10. How can I get the current tab URL for chrome extension?
  11. Content script matching top-level domains like all google.*
  12. How can I enable my chrome extension in incognito mode?
  13. Insert an image in chrome extension
  14. How to disable (gray out) page action for Chrome extension?
  15. Inject HTML into a page from a content script
  16. chrome.identity User Authentication in a Chrome Extension
  17. Can I modify outgoing request headers with a Chrome Extension?
  18. Is it possible to inject a javascript code that OVERRIDES the one existing in a DOM? (e.g default alert function)
  19. How do I import scripts into a service worker using Chrome extension manifest version 3?
  20. Cross-origin request in a content script is blocked by CORB despite the correct CORS headers
  21. Add contextmenu items to a Chrome extension’s browser action button
  22. How to make a cross-origin request in a content script (currently blocked by CORB despite the correct CORS headers)?
  23. Google Chrome Extensions – Open New Tab when clicking a toolbar icon
  24. Chrome version 18+: How to allow inline scripting with a Content Security Policy?
  25. What does “http://*/*”, “https://*/*” and “” mean in the context of Chrome extension’s permissions
  26. CORS issue doesn’t occur when using POSTMAN
  27. How can I detect the current tab’s mime type in a Google Chrome extension?
  28. Chrome Console SameSite Cookie Attribute Warning
  29. Passing message from background.js to popup.js
  30. Accessing `window`/DOM/HTML of the webpage from the extension

Leave a Comment