Staged rollouts and rollback for browser extensions: what to expect

The Chrome Web Store lets developers roll an update out to a percentage of users and roll back a bad release right away. For users, that means a new version may reach you before or after your colleagues. For developers, it is a safety valve you should set up before you need it.

How staged rollout works

From Google's publishing guide:

• It is available only for already published items with more than 10,000 seven-day active users.
• You choose the percentage after uploading a new draft, and you can raise it later up to 100 percent without a new review.
• Only one partial rollout can run at a time, and publishing a new version stops the previous rollout to new users.
• If the last published version was taken down or warned, the next version must go to 100 percent.

Updates go through essentially the same review as new items, and existing users see no change until the update is published.

Rollback

The guide says to use the Web Store rollback to revert a bad update immediately. The dashboard also offers cancel publish, cancel review, defer publish and unpublish, depending on the item's status. Rolling back is only useful if the previous version is still good, so keep release records that tell you which version that is.

What this means if you are a user

Different people can run different versions at the same time, so two colleagues can see different behavior. If something looks wrong after an update, note the version number and tell your administrator. Chrome's permission prompt is still the main visible change signal.

What this means if you manage browsers

Staged rollouts are a developer-side control, not yours. Yours are policy controls: pin the allowed list, remove a bad extension, and use a minimum version once a fix exists. See the installation modes.

A developer's release plan

1. Use a staged rollout for any release that changes permissions or touches data handling.
2. Watch error reports and support channels during the first stage.
3. Keep a known-good package ready to roll back to.
4. Have a written plan for a compromised account: unpublish, rotate credentials, publish a clean version, inform users. Opt into signed uploads to reduce the chance of a hostile update.
5. Publish release notes that say what changed and why.

Limits of the safety net

A staged rollout does not detect malice. It limits exposure while you watch for problems. If the problem is a deliberate backdoor, a small percentage of users may still be affected. It is a way to make mistakes smaller, not a security check.

Quick check

Sources

• Update your Chrome Web Store item

Last reviewed: 19 October 2026.