In a bid to ensure that the Chrome Web Store doesn’t host any malicious Chrome extensions, Google routinely updates the platform’s privacy policies. Back in October 2018, the company announced one such update which was aimed at making extensions more secure. As part of the update, Google introduced new user controls for host permissions, made changes to the extensions review process, added new code readability requirements, and made 2-Step Verification necessary for Chrome Web Store developer accounts. While such changes are great for keeping malicious extensions off the platform, they now seem to be affecting legit Chrome extensions like Pushbullet and Join.
The developers behind Pushbullet and Join were recently alerted by Google that their extensions didn’t comply with the Chrome Web Store’s privacy policy and violated the “Use of Permissions” section. When the developers reached out to Google inquiring how their extensions violated the privacy policy, the company reverted back with a generic reply that states:
“Your product violates the “Use of Permission” section of the policy, which requires that you:
Request access to the narrowest permissions necessary to implement your product’s features or services.
If more than one permission could be used to implement a feature, you must request those with the least access to data or functionality.
Don’t attempt to “future proof” your product by requesting a permission that might benefit services or features that have not yet been implemented.”
In response to the aforementioned reply, Pushbullet’s developer reduced the extension’s permission requests and resubmitted the extension for review. However, the updated extension was rejected once again and the company gave the same reason as before. When asked for further clarification, Google didn’t respond to the developer’s email. The developer now plans to make a few other changes to the permission requests and submit the extension for review again. But that brings up another issue. Chrome Web Store’s privacy policy states that multiple resubmission “may also result in the suspension of related Google services associated with your Google account” as Google’s automated system might think that the developer is trying to find a way around the rules with multiple submissions.
