Home › Chrome extensions › Chrome extension (Manifest V3) rules
Chrome extension (Manifest V3) rules
Cursor rules for building Manifest V3 browser extensions with TypeScript and minimal permissions.
CursorChrome extensions
How to use
Save this as .cursor/rules/chrome-extension.mdc in your repository root, commit it, and your agent will pick it up automatically. Edit the commands to match your project.
.cursor/rules/chrome-extension.mdcDownload ---
description: Chrome extension MV3 conventions
alwaysApply: true
---
# Chrome Extension (Manifest V3)
- Manifest V3 only. Background logic runs in a service worker: it can be terminated at any time, so keep no in-memory state — persist with `chrome.storage`.
- Request the minimum permissions. Prefer `activeTab` and optional permissions over broad `host_permissions` like `<all_urls>`.
- No remote code: never `eval`, inject remote scripts, or load JS from a CDN. Bundle everything (Vite/WXT/Plasmo).
- Content scripts are isolated; talk to the service worker with `chrome.runtime.sendMessage` and typed message objects.
- Register listeners at the top level of the service worker, synchronously.
- Sanitize any page data before inserting it into extension UI; never use `innerHTML` with untrusted content.
- Use `chrome.alarms` instead of `setInterval` for periodic work.
- Keep a short privacy note of what data is accessed — Chrome Web Store review requires it.