Skip to content

Add an API to trigger extension update #112

@nir-walkme

Description

@nir-walkme

Currently, browsers are checking for new versions of an extension in an interval of a few hours. Sometimes it can take more than a day for an extension to get updated for a user.

This may have critical outcomes in case the extension update was meant to fix a security vulnerability or a critical bug.
In today's world where SaaS applications are dominant, this behavior is no longer the standard. Today's users expect instant updates in case of a security vulnerability or a critical bug.
Moreover, modern hackers are used to exploiting zero day vulnerabilities very fast and every second counts until the vulnerability gets fixed.

Manifest V3 makes this problem even more severe. In Manifest V3 remotely hosted code is no longer allowed. This means that more critical code will be embedded in the extension and not served from a remote domain. The need to update the extension quickly now becomes more imperative.

We suggest to add an API for the extensions to ask the browser to check for extension update (either if it hosted on the store or remotely hosted).

The typical use case would be:

  1. The extension is communicating frequently with a remote server to receive configuration and data.
  2. In case of a security vulnerability or a critical bug and after a fix was released, the remote server would notify the extension.
  3. The extension would call the mentioned new API.
  4. The browser will check if an update exists and will install the new version.

Metadata

Metadata

Assignees

No one assigned

    Labels

    enhancementEnhancement or change to an existing featureimplemented: chromeImplemented in Chromeneeds-triage: safariSafari needs to assess this issue for the first timesupportive: firefoxSupportive from Firefox

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions