Yes, but only on managed machines. Chrome's policy documentation says extensions from outside the Chrome Web Store can be force-installed on Windows only if the device is joined to a domain, joined to Azure AD, or enrolled in Chrome Enterprise Core, and on macOS only if it is managed through MDM, joined via MCX, or enrolled in Chrome Enterprise Core.
Why the restriction exists
Chrome's developer documentation states that Linux is the only platform where ordinary users can install extensions hosted outside the Chrome Web Store. On Windows and macOS, a random web page cannot hand someone a self-hosted extension. Management is the gate, and that is a good thing: it keeps off-store installs inside the set of machines you control.
The requirements at a glance
| Platform | What the device must be |
|---|---|
| Windows | Joined to Active Directory, joined to Azure Active Directory, or enrolled in Chrome Enterprise Core |
| macOS | Managed via MDM, joined to a domain via MCX, or enrolled in Chrome Enterprise Core |
| Linux | Users can install self-hosted extensions without management, per Chrome's developer docs |
This text comes from the definitions of the ExtensionInstallForcelist and ExtensionSettings policies. Check the current policy pages before you rely on it, since browser behavior changes between releases.
What you take on by self-hosting
When the store hosts an extension, you rely on its review process and the publisher's account security. When you host it yourself, you replace that with your own duties:
- A signing key. Chrome requires every update to be signed with the same private key as the installed version. Lose it and you cannot update. Leak it and someone else can.
- An update server. The update manifest and package files sit on a server you run, which becomes part of your supply chain.
- Your own review. Nobody else has looked at this build. A second engineer should read every release diff.
- A version history. Keep old packages and a record of which version was live when.
When self-hosting is reasonable
It fits an internal tool that cannot go in a store listing, such as an extension that talks only to an internal system. If the extension is generic, a store listing with private or domain visibility may be simpler. Our guide to visibility options compares them.
A minimal self-hosting checklist
- Confirm every target device meets the platform condition above.
- Generate the signing key on a trusted machine and store it outside the web server.
- Serve the update manifest and packages over HTTPS.
- Require code review and a second approver for each release.
- Add the extension to the force-install list with its update URL.
- Log who published each version.
Quick check
Can I self-host extensions for unmanaged BYOD phones or laptops?
Not through force-install policy. The policy conditions above require a managed or enrolled device, so unmanaged devices fall outside this route.
Do I need my own server to self-host?
You need somewhere to serve the update manifest and the package. The force-install policy accepts http, https and file URL schemes, but anything shared across a network should use HTTPS.
Sources
- Chromium policy definition: ExtensionInstallForcelist
- Chromium policy definition: ExtensionSettings
- Chrome for Developers: Self-host for Linux
Last reviewed: 19 October 2026.
