-
Notifications
You must be signed in to change notification settings - Fork 79
Description
Currently, browsers are checking for new versions of an extension in an interval of a few hours. Sometimes it can take more than a day for an extension to get updated for a user.
This may have critical outcomes in case the extension update was meant to fix a security vulnerability or a critical bug.
In today's world where SaaS applications are dominant, this behavior is no longer the standard. Today's users expect instant updates in case of a security vulnerability or a critical bug.
Moreover, modern hackers are used to exploiting zero day vulnerabilities very fast and every second counts until the vulnerability gets fixed.
Manifest V3 makes this problem even more severe. In Manifest V3 remotely hosted code is no longer allowed. This means that more critical code will be embedded in the extension and not served from a remote domain. The need to update the extension quickly now becomes more imperative.
We suggest to add an API for the extensions to ask the browser to check for extension update (either if it hosted on the store or remotely hosted).
The typical use case would be:
- The extension is communicating frequently with a remote server to receive configuration and data.
- In case of a security vulnerability or a critical bug and after a fix was released, the remote server would notify the extension.
- The extension would call the mentioned new API.
- The browser will check if an update exists and will install the new version.