---
description: Chrome extension MV3 conventions
alwaysApply: true
---

# Chrome Extension (Manifest V3)

- Manifest V3 only. Background logic runs in a service worker: it can be terminated at any time, so keep no in-memory state — persist with `chrome.storage`.
- Request the minimum permissions. Prefer `activeTab` and optional permissions over broad `host_permissions` like `<all_urls>`.
- No remote code: never `eval`, inject remote scripts, or load JS from a CDN. Bundle everything (Vite/WXT/Plasmo).
- Content scripts are isolated; talk to the service worker with `chrome.runtime.sendMessage` and typed message objects.
- Register listeners at the top level of the service worker, synchronously.
- Sanitize any page data before inserting it into extension UI; never use `innerHTML` with untrusted content.
- Use `chrome.alarms` instead of `setInterval` for periodic work.
- Keep a short privacy note of what data is accessed — Chrome Web Store review requires it.