New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 899396 link

Starred by 4 users

Issue metadata

Status: Available
Owner: ----
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux , Windows , Chrome , Mac
Pri: 3
Type: Feature

Blocking:
issue 917049



Sign in to add a comment

implement pinned version in ExtensionSettings

Project Member Reported by goanuj@chromium.org, Oct 26

Issue description

Some enterprise customers want to be able to force a specific version of an extension to be used.

eg. "specific_version_required" or "pinned_version_required" : maps to a version string.

The format of the version string is the same as the one used in extension manifest, as described at https://developer.chrome.com/apps/manifest/version. 

An extension with a version other than the specified version will be disabled and will be noted in chrome://policy.  This applies to force-installed extensions as well.
 
AFAIK, the Chrome Webstore only stores the latest version of an extension. It may be helpful to bring the Chrome Webstore folks into the discussion since most of the effort for such a feature would likely be on their side.

Version pinning of software can be quite dangerous from a security perspective. If an extension has a vulnerability and the author releases a fix, users pinning to an older version wouldn't be protected. 

IMHO if extension version pinning is implemented it'd be important to 
1. Notify an Admin/User that the pinned version is vulnerable
2. Automatically unload/block vulnerable pinned versions
Pinning provides the controls for enterprise customers and they knowingly know that the compromise is at the price of security for stability when they do.

I do like the idea of having the mechanism to alert both admin/user when a pinned version is vulnerable (having control over not alerting the user would likely be required by admins)

Perhaps this can be done with our enterprise reporting capability.  

Comment 3 Deleted

Cc: rdevlin....@chromium.org robertshield@chromium.org privard@chromium.org georgesak@chromium.org nparker@chromium.org bheenan@chromium.org jawag@chromium.org
 Issue 904849  has been merged into this issue.
I'll echo nrpeter@'s comment that we don't keep the old version in the store, which is problematic.

What would we do if a fresh install needs an older version?
Cc: -rdevlin....@chromium.org devlin@chromium.org lottie@chromium.org
Components: Enterprise
I agree it would be difficult to backport this feature to extensions written with Manifest-v2, but the Chrome Web Store could keep multiple versions of extensions with Manifest-v3. This would give developers an incentive to move to v3 as well.

Just a FYI that Manifest v3 is public now: https://docs.google.com/document/d/1nPu6Wy4LWR66EFLeYInl3NzzhHzc-qnk4w4PX-0XMw8/edit#



Status: Assigned (was: Unconfirmed)
Owner: ----
Status: Available (was: Assigned)
We're now tracking this in the extensions product backlog as a possible feature to implement for manifest v3 extensions. We'll pick this bug up again in the future as manifest v3 implementation progresses.
Labels: Enterprise-Triaged
I wanted to also add that with pinning, there is also a request to be able to rollback to an older extension.  This might be considered a separate FR.  But I wanted to also highlight this here. 
Blocking: 917049

Sign in to add a comment