The Allow User Scripts toggle on an extension's details page turns on Chrome's userScripts API for that extension. The API lets an extension run arbitrary scripts that are not in its package, which is how script manager extensions work. Leave it off unless you need such a manager, and only run scripts you have read.
What the API is for
Manifest V3 forbids remotely hosted logic, but a script manager has to run code written by the user or downloaded from a script site. Google's reference says the userScripts API exists for extensions that run user-supplied scripts that cannot ship in the package. It needs the userScripts permission plus host permissions for each site the scripts run on, and it is available from Chrome 120.
How you turn it on
From Chrome 138, you enable it with the Allow User Scripts toggle on the extension's details page. Before Chrome 138, you needed Developer mode switched on at the extensions page. If the toggle is off, the API is not available to that extension.
This design is a deliberate speed bump. The browser makes you opt in per extension, so a script manager cannot quietly run code from the web the moment you install it.
Where scripts run
By default scripts run in an isolated USER_SCRIPT world, separate from the page and other extensions and exempt from the page's content security policy. They can instead run in the MAIN world, which shares the page's JavaScript environment, so the page and other extensions can see them.
Google also notes that messages from user scripts should be treated as coming from a less trusted context, which is why they arrive through dedicated handlers.
Risks worth naming
- A script manager with this power plus broad host access can run any code from any script you add, on any site it covers.
- Third-party scripts can change after you install them, depending on how the manager updates them.
- A script that reads a page can read what you type into it.
A practical stance
- Do not enable the toggle on extensions that do not need it.
- Read a script before adding it, or use only scripts from sources you can verify.
- Restrict the extension's site access to specific sites rather than all sites. See our site access guide.
- Keep this setting out of shared or work profiles unless your policy allows it.
Quick check
Is the toggle the same as Developer mode?
Not in Chrome 138 and newer. Google's page says users enable the API with the Allow User Scripts toggle. Before 138 it required Developer mode.
Does a script manager break the remote code rule?
The userScripts API is the sanctioned route for user-supplied scripts, and Google's store policy lists the User Scripts API as an exception to the remote code rule, subject to restrictions.
Sources
Last reviewed: 19 October 2026.
