The Chrome Web Store prohibits deceptive installation tactics: misleading buttons, hidden listing details, bundling other extensions into the install flow, and requiring unrelated actions to reach a feature. Knowing the list helps you spot an extension that is trying to get installed through tricks rather than a clear offer.
What the policy lists
Google's program policies say marketing must state an extension's functionality clearly and that user outcomes must match what was promised. Prohibited tactics include:
- Misleading ads or call-to-action buttons.
- Hiding listing metadata.
- Bundling other extensions or offers into the install flow.
- Requiring unrelated actions to reach advertised features.
Related rules push in the same direction. An extension must have a single purpose that is narrow and easy to understand, and unrelated functions should be separate extensions that users can install and remove independently. Spam is also covered: duplicate extensions, manipulated ratings or install counts, and notification spam are prohibited.
Signs to watch for
- A website or ad that says "install to continue" before a download, video or document.
- A listing whose description does not match its permissions.
- An extension that, after install, changes your search engine, new tab page or home page when you did not ask. Mozilla's policies state add-ons must not load or redirect to a remote new tab page.
- Notifications that start without your consent.
- A flood of nearly identical five-star reviews.
What to do
- Do not install from a pop-up or an advert. Search the store directly.
- Open the listing and compare the description with permissions and privacy practices.
- If it already installed, review it with the five minute audit and remove what you do not recognize.
- If it did something harmful, follow the response guide.
- Report the listing through the store's reporting link so others are protected.
For organizations
Block installation from untrusted sources and default to an allowlist. Staff then cannot be tricked into installing from an ad. The policy options show how.
Why it works on people
These tactics succeed because they show up at a moment of need: someone wants a file converted, a video watched or a form filled, and the page says one click will do it. The extension arrives with broad access and a vague purpose. A simple habit helps. If a site demands an extension for something that should not need one, close the tab and look for another route.
For teams, a short training note with two or three screenshots of typical install prompts does more than a long policy. Pair it with an allowlist so a mistaken click does not turn into an incident.
Quick check
Is bundling another extension allowed if the user agrees?
Google's policy lists bundling other extensions or offers into the install flow among prohibited deceptive tactics.
If a listing breaks these rules, is it still safe because it is in the store?
No. Store presence is not a guarantee. Report it and remove it.
Sources
Last reviewed: 19 October 2026.
