Blog
Chrome extension Manifest V3: host_permissions, CORS for cross-origin fetches, and service worker limitations
Extensions can declare `host_permissions` to bypass same-origin policy for `fetch`—document which APIs your content script never touches.
1 min read
chrome-extensionmanifest-v3cors
Content scripts
Isolated worlds do not share page cookies—CORS on the page and extension contexts can diverge confusingly.
Message passing to background workers should serialize minimal data to avoid leaking tokens across origins.
Review
Chrome Web Store review may flag broad `<all_urls>`—justify CORS-related needs in your privacy policy.
Enterprise policy updates can revoke permissions—monitor CORS regressions for managed browsers.