Extension storage follows its own rules. It is not cleared when you clear browsing data, cookies set on extension pages are always SameSite Lax, and web storage calls from a content script touch the host page, not the extension. Knowing these helps you review data handling correctly.
Storage survives clearing browsing data
Google's documentation states that extension storage is not cleared when a user clears browsing data, which includes Local Storage and IndexedDB. If an extension stored a token or personal data, wiping history will not remove it. To clear it, remove the extension or use the extension's own reset option. We cover this in more depth in a separate post.
Content scripts see the page's storage
In content scripts, web storage calls access the host page's data, not the extension's. This is a frequent source of bugs and a security smell. A developer who writes secrets to localStorage from a content script has put them in a place that the site's own scripts can read.
Shared across extension contexts
Storage is shared across the extension's origin, including the service worker, extension pages like popups and side panels, and offscreen documents. Service workers can use IndexedDB and Cache Storage but not Local Storage or Session Storage, so developers use an offscreen document when they need those.
Persistence and quotas
Storage is normally subject to quotas and can rarely be evicted under heavy memory pressure. The unlimitedStorage permission exempts the extension from quotas, and navigator.storage.persist is another route. A request for unlimited storage is not dangerous by itself, but ask why. An extension that needs to keep large amounts of data locally should be able to explain it.
Cookies on extension pages
Google's page lists several quirks:
- Extension pages cannot set cookies with the Secure attribute, so they cannot use SameSite=None or Partitioned.
- Cookies set on chrome-extension pages always use SameSite=Lax, so they cannot be accessed in frames.
- Requests from an extension to a third party with host permissions are treated as same-site, so SameSite=Strict cookies can be sent. This applies to network requests, not document.cookie.
That last point is the one for threat models. A site's SameSite protections assume requests come from outside. An extension with host permissions sits inside that assumption. See how SameSite settings work.
Review checklist
- What does the extension store, and where?
- Does any content script write sensitive values to page storage?
- Is there a way for the user to see and delete what is stored?
- Does a request for unlimited storage match the stated purpose?
- What happens to stored data when the extension is removed or the account changes?
Quick check
Does clearing browsing data remove an extension's stored data?
No. Google's documentation says extension storage is not cleared when you clear browsing data.
Where does localStorage point inside a content script?
At the host page's storage, not the extension's.
Sources
Last reviewed: 19 October 2026.
