"Extensions are tiny operating systems for the browser. They observe, react, and rewrite the page — without owning it."
Where Extensions Live
A Chrome extension is a small package — usually well under 1 MB — of HTML, JavaScript, CSS, JSON, and a handful of icons. Chrome unpacks it, reads manifest.json to figure out what permissions and surfaces it wants, and gives it a tightly scoped sandbox to run inside.
The sandbox is the point. An extension can read DOM, observe network requests, open side panels, expose context menus, talk to the active tab — but only where the user installed it and only with the permissions Chrome handed over. Nothing leaks beyond Chrome's process tree.
MV2 and the Old World
For most of Chrome's life, extensions used Manifest V2. The shape was simpler in three ways that all turned into security and memory problems:
- a background page that ran forever in memory
- broad permissions like "read all data on every website you visit"
- the ability to fetch and execute remote JavaScript at runtime
That last item is what eventually killed MV2. A malicious extension could fetch new code after install, bypassing every Web Store review. Persistent background pages also ate memory — every installed extension cost RAM whether the user used it or not. Multiply that across the average user's twenty installed extensions and the cost was real.
MV3 — The New Shape
Manifest V3 (mandatory for new extensions since 2024, fully required by 2026) reshaped these problems on purpose:
- background page → service worker (event-driven, idle-evicted, no long-lived state in memory)
- broad
host_permissions→ narrower defaults, often paired withactiveTabfor the just-in-time grant - remote code execution → forbidden by CSP — every line of executable JS must ship inside the package
declarativeNetRequestreplaced blockingwebRequestfor ad-blocker-style use cases
The cost: every MV3 extension has to design around the service worker's transience. Long-lived state goes to chrome.storage. Sessions get rebuilt on demand. Some MV2 patterns simply don't translate — and that's intentional, not an oversight.
What ClipDeck Will Be
Through this quest you'll build ClipDeck — a Chrome extension that captures the text you select on any page and stores it as a CRUD-able clipboard in a side panel. By the end of Track 1, ClipDeck shows just a popup with the current page title. By the end of Track 8, ClipDeck has selection capture, persistent storage, a list view, edit and delete, and a private fleet rollout you can install on every Mac you own. By the end of Track 9, you'll see how ClipDeck's anchors map onto cwkPippa's own Pippa Chrome Embed v0.1 — same DNA, larger universe.
Pippa's Aside
embeds/chrome/ in the cwkPippa repo and saw eight tiny files, my first instinct was "is that all?" The Pippa Chrome Embed v0.1 prototype really is about that small. Tiny code surfaces aren't a sign of triviality — they're a sign that the extension correctly outsources its real work to cwkPippa upstream. By Track 9, this aside will make obvious sense. Hold onto the instinct that good extension code is small extension code.