The tables below list the keys Chrome documents, and the keys only MDN’s Firefox documentation has. Browsers do not all support every key. The structure of the main keys follows.
Keys
| Key | Holds |
|---|---|
manifest_version, name, version | The required keys. |
description, icons | Required for the Chrome Web Store. |
action | The toolbar button’s icon, tooltip and popup. |
background | The background context. |
chrome_settings_overrides | Browser settings it replaces. |
chrome_url_overrides | Browser pages it replaces. |
commands | Keyboard shortcuts. |
content_scripts | Scripts and styles injected into pages. |
content_security_policy | What the extension’s pages may load. |
cross_origin_embedder_policy, cross_origin_opener_policy | Headers for extension pages. |
declarative_net_request | Static rules that block or change network requests. |
default_locale | The default language. Must be present if _locales/ exists, and absent otherwise. |
devtools_page | A page that uses the DevTools APIs. |
export, import | Resources shared between extensions. |
externally_connectable | Which pages and extensions may connect to this one. |
homepage_url | A home page. |
host_permissions, optional_host_permissions | Sites the extension may touch. |
incognito | How it behaves in incognito windows. |
key | A public key, for a fixed ID during development. |
mime_types_handler | Registers it as a handler for certain file types. |
minimum_chrome_version | The oldest Chrome that may install it. |
oauth2 | OAuth 2.0 client ID and scopes. |
omnibox | A keyword in the address bar. |
optional_permissions, permissions | Extension APIs it may use. |
options_page, options_ui | Its options page. |
requirements | Technologies it needs. |
sandbox | Pages that run without extension APIs. |
short_name | A shorter name. |
side_panel | A file for the side panel. |
storage | A schema for the managed storage area. |
tts_engine | Registers it as a text-to-speech engine. |
update_url | The update page for self-hosted extensions. |
version_name | A label for the version, such as a beta or build tag. |
web_accessible_resources | Files pages may load. |
file_browser_handlers, file_handlers, file_system_provider_capabilities, input_components | ChromeOS only. |
These keys are in MDN’s list and not in Chrome’s:
| Key | Note |
|---|---|
author, developer | |
browser_action, page_action | Manifest V2 toolbar buttons. |
browser_specific_settings | Settings per browser. |
dark_theme, theme | |
dictionaries | |
protocol_handlers, theme_experiment | Firefox only. |
sidebar_action | |
user_scripts | Manifest V2 only. |
background
| Key | Holds |
|---|---|
service_worker | A JavaScript file used as the extension’s service worker. The only form Chrome supports in Manifest V3. |
scripts | A list of JavaScript files that run in one background context, in order. Supported by Firefox and Safari in Manifest V3. |
page | An HTML page used as the background. Not with scripts. |
persistent | In Manifest V2: true keeps the page in memory; false makes an event page. In Manifest V3 it cannot be true. |
type | classic (the default) or module. |
preferred_environment | The order of preference when both a service worker and scripts are given. |
content_scripts
An array of objects, each saying which pages get which files.
| Key | Holds |
|---|---|
matches | Required. Match patterns for the pages. |
js | JavaScript files, injected in order, after the CSS. |
css | CSS files, injected in order, before the page is built or drawn. |
exclude_matches | Patterns that block injection even when matches applies. |
include_globs, exclude_globs | Wildcards (* and ?) applied after matches. |
all_frames | Default false: only the top frame. true: every matching frame. |
match_about_blank | Also injects into about:blank frames whose parent matches. |
match_origin_as_fallback | Also injects into frames with another scheme, such as data: or blob:, created by a matching origin. |
run_at | document_start, document_end or document_idle (the default). |
world | ISOLATED (the default) or MAIN, the page’s own JavaScript environment. |
action
| Key | Holds |
|---|---|
default_icon | The toolbar icon: one path, or a map from pixel size to path. |
default_title | The tooltip. |
default_popup | The HTML file of the popup. |
default_area | Firefox only: where the button starts. |
theme_icons | Icons matched to the theme, each light, dark and size. |
web_accessible_resources
In Manifest V3 this is an array of objects, each with resources and at
least one of matches and extension_ids. In Manifest V2 it is
a flat list of paths, open to every site and extension.
| Key | Holds |
|---|---|
resources | Relative paths, with * wildcards allowed. |
matches | Origins that may load the files. |
extension_ids | Extensions that may load the files; * means all. |
use_dynamic_url | When true, the files are reachable only through a per-session dynamic ID. |
content_security_policy
In Manifest V2 this is one string, the same syntax as the Content-Security-Policy HTTP header. In Manifest V3 it is an object:
| Key | Holds | Chrome’s default |
|---|---|---|
extension_pages | The policy for popups, background workers and extension pages. | script-src 'self'; object-src 'self'; |
sandbox | The policy for the pages declared in sandbox. | sandbox allow-scripts allow-forms allow-popups allow-modals; script-src 'self' 'unsafe-inline' 'unsafe-eval'; child-src 'self'; |
Chrome’s minimum policy for extension_pages is
script-src 'self' 'wasm-unsafe-eval'; object-src 'self';. It cannot be
relaxed further: adding 'unsafe-eval' to script-src stops
the extension installing.
browser_specific_settings
Firefox reads gecko and gecko_android; Safari reads
safari; Chrome ignores the key.
| Key | Holds |
|---|---|
gecko.id | The add-on’s ID: an @string or email-like string, or a GUID in braces. Required for signing in Manifest V3. |
gecko.strict_min_version, strict_max_version | The Firefox versions it works with. |
gecko.update_url | An https address of an update manifest, for add-ons not hosted by Mozilla. |
gecko.data_collection_permissions | required and optional lists of the data it collects. New add-ons sent to addons.mozilla.org from 3 November 2025 must have it. |
gecko_android | The versions of Firefox for Android; an empty object makes it available there with no version limits. |
safari | strict_min_version and strict_max_version. |