标签：#chrome

Caricare un’estensione da disco, aprirne il popup e automatizzare verifiche UI: un workflow più completo per chi sviluppa estensioni e usa agenti. Sviluppare un’estensione Chrome oggi significa spesso alternare tre modalità: codice “a mano”, generazione assistita da un coding agent e una fase di verifica nel browser che resta comunque imprescindibile. Il problema è che molti agenti riescono ad aprire pagine e cliccare elementi, ma si fermano quando entrano in gioco le estensioni: installazione, gestione del popup, interazioni con la UI dell’estensione, verifica rapida dei cambiamenti. Chrome DevTools for agents colma proprio quel vuoto: aggiunge al set di strumenti dell’agente la possibilità di installare e pilotare un’estensione durante i test, oltre a renderne più pratico il debugging. Quando è davvero utile Ci sono alcuni scenari tipici in cui il supporto “estensioni-aware” fa la differenza: Ciclo di feedback più rapido : compili/packi l’estensione, la carichi in Chrome e verifichi subito il popup o una content script UI. Test end-to-end più realistici : invece di simulare una UI in una pagina fittizia, testi l’estensione nel suo contesto reale (action popup, permessi, storage, ecc.). Validazione automatizzata : l’agente può controllare che l’estensione si installi correttamente, che il popup si apra e che i componenti principali siano presenti e interagibili. In pratica: se il tuo agente sa “guidare” il browser ma non sa “gestire” le estensioni, la qualità del test rimane limitata. Setup: abilitare esplicitamente gli strumenti per le estensioni Un dettaglio importante: per ragioni di sicurezza e controllo (in particolare per l’uso dei token e del contesto in cui operano gli agenti), le funzionalità specifiche per estensioni non sono abilitate di default . Dopo aver installato Chrome DevTools for agents, serve quindi un passaggio esplicito nella configurazione MCP: individua il tuo file di configurazione MCP ; abilita la categoria dedicata alle estensioni aggiung

Six weeks ago I got cut off mid-debugging session by Claude's rate limit with no warning. Two hours of context gone. I started looking for a tool that would show me how close I was before it happened. Nothing existed that worked across more than one platform without requiring an API key. So I built one. TokenPulse is a Chrome extension (MV3) that injects a live token bar above the input box on Claude, ChatGPT, Gemini, DeepSeek and Grok. It tracks context window usage, rate limits, cost estimates, and daily history — all from your existing browser session, no API key required. Here's how it works technically. Architecture overview Content Scripts (per platform) ↓ Background Service Worker ↓ Chrome Storage API (local) ↓ Popup UI ↓ Desktop Notifications The extension runs a content script on each supported domain. Each script is responsible for: Reading token usage data from that platform Injecting the visual bar above the input box Sending data to the background service worker via chrome.runtime.sendMessage The service worker aggregates data, writes to chrome.storage.local , checks notification thresholds, and serves data to the popup on demand. How Claude's rate limits are read Claude is the only platform that exposes real rate limit data through its internal API. When you use claude.ai, the browser session makes requests to a usage endpoint that returns exact utilization percentages and reset timestamps. The content script intercepts this data by hooking into the platform's network requests using a MutationObserver to detect when Claude updates its state, then reading the cached response. The response looks roughly like: { five_hour : { utilization : 0.82 , reset_at : " 2026-07-15T14:14:00Z " }, seven_day : { utilization : 0.34 , reset_at : " 2026-07-21T21:00:00Z " } } This gives exact percentages — not estimates. The popup shows these directly. Client-side token estimation for other platforms ChatGPT, Gemini, DeepSeek and Grok don't expose usage data the same way.

"We have some really ambitious plans to help you work with AI in Chrome to get things done, and I’ll have more to share soon," Jacob Bank, Relay founder and CEO, said.

On 11 August the GoFullPage extension disappeared from the Chrome Web Store and got disabled in Chromium browsers. Eleven million users, one Tuesday. It was not a hack. The developers say it was a copyright dispute over a design element, that it was "definitively not a security issue", and that they are working with Google on getting it back. Chrome shows the same "might be unsafe" string for every kind of Web Store policy breach, so the warning read far worse than the cause. Two things came out of it. A short list of fixes, and a longer thought about where our tools live. Get working again in a minute Re-enable it. Open chrome://extensions . If Chrome disabled the extension rather than deleting it, the toggle is still there. Use Edge. GoFullPage was never removed from the Edge add-ons store. Install the beta. The team published a separate build at ID kehafhfdnkhdgbnpeofmhmbibmpnjaof , and it can sit alongside the original. That is the practical answer. The more interesting one is that most of us never needed the extension. Five ways to capture a full page with no extension at all 1. Chrome DevTools, no code Open DevTools, press Cmd/Ctrl + Shift + P , type screenshot , choose Capture full size screenshot . This has been in Chrome for years and most people have never found it. It handles scroll-height pages properly and drops a PNG in your downloads. 2. Firefox, even shorter In the Firefox console: :screenshot --fullpage Add --dpr 2 for a retina-density capture, or --clipboard to skip the file. 3. Chrome DevTools Protocol, if you want it scripted The thing the extension was wrapping is one CDP call: await client . send ( ' Page.captureScreenshot ' , { format : ' png ' , captureBeyondViewport : true , }); captureBeyondViewport is the flag that does the work. Everything else in a full-page screenshot tool is UI around it. 4. Playwright import { chromium } from ' playwright ' ; const browser = await chromium . launch (); const page = await browser . newPage ({ viewport

I thought I had a settings bug. What I actually had was three different kinds of state pretending to be one boolean. While building a Chrome Manifest V3 email-tracker blocker, I expected a simple flow: you flip Gmail on in the settings, and the extension starts working in Gmail. That was the theory, anyway. The problem showed up when I was testing on a second Chrome profile. I'd enabled Gmail on my main profile, and Chrome Sync helpfully carried that preference over to the other one. But the optional permission for mail.google.com didn't come along — host grants live in the local profile and never sync. Profile number two now believed Gmail was enabled while lacking the host grant needed to inject the inbox content script or inspect its DOM. Depending on how you write your code, that's either a silent no-op or an extension quietly behaving as if access exists when it does not. Neither is great. Once I stopped and wrote it down, the picture got clearer. There are three separate things here: the inbox the user wants enabled, the host access Chrome has actually granted in this profile, and the dynamic DNR rules that are currently installed . Collapsing them into one flag is convenient. It's also wrong. The manifest is a menu, not an order The extension declares each webmail origin under optional_host_permissions . Every inbox gets activated on its own, and Chrome only asks the user for access when they turn that particular integration on. Here's the thing I had to internalize: declaring an optional origin means nothing by itself. Until the live grant exists, the extension has no business registering a content script for that inbox, poking at its DOM, or — by its own scoping policy — activating client-scoped blocking rules for it. Why bother with per-inbox prompts at all? Mostly trust. A tracker blocker that asks for all your webmail up front looks exactly like the thing it's supposed to protect you from. Asking for Gmail when you enable Gmail — and nothing more — is an

This article was originally published on e-shikumi-labo . Hello, I'm Shin from e-Shikumi-Labo. How do you all manage your conversations with Gemini? When you manage to extract a useful response from the AI, have you ever thought, "I want to keep this somewhere"? It all started from a simple, practical desire in my daily work: "I want to automatically save useful conversations from Gemini to a spreadsheet before they fade away." So, borrowing the power of Generative AI (Gemini), I tried making my own personal Chrome extension. Over this four-part series, I will write about "systematized thinking"—the process of utilizing AI to build tools and independently maintaining them. In Part 1, I'll share the developmental dialogue process: "How did I instruct the AI, what information did I provide, and how did we complete the prototype?" 1. A Prompt That Says: "Don't Guess, Ask for the Information You Need" As the very first step in development, I threw this prompt directly at Gemini itself. "I want to save Gemini's responses to a spreadsheet using a Chrome extension. Tell me how to build it without using your imagination. If you need any specific information, please point it out." The key here lies in two constraints: "without using your imagination" and "point out if you need information." When you try to build a web data extraction tool using AI, the AI often tends to "guess" the internal structure of the webpage (like HTML tags and class names) on its own and write the code. And even when you test this supposedly completed code, you fall into the trap of it not working because it doesn't align with the actual screen structure. To avoid this trap, I explicitly communicated, "Don't guess on your own. If there's missing information, I want you to demand it from the human side." 2. A Game of Catch with AI Using DevTools When I threw this prompt, the AI returned the following response: AI: "Understood. To create code that works reliably while eliminating guesswork, please retr

The Asus Chromebook Plus CX34 is a dependable laptop that doesn’t cost a fortune, despite being nearly three years old. It’s cheaper than usual right now, and you have a few options in the sub-$400 range. The option with the most storage is currently on sale for $399.99 (about $100 off recent prices) at Amazon. […]

TL;DR: Google’s Gemini AI agents identified and helped remediate 1,072 Chrome security flaws in 60 days, dramatically shrinking the window for attackers. The race to protect 3.5 billion Chrome users has taken a high‑tech shortcut. Instead of relying solely on human researchers, Google deployed its Gemini‑powered AI agents to hunt for bugs, triage findings, and even suggest patches. The result? Over a thousand vulnerabilities squashed in just two months—a pace that would have taken years using traditional methods. How Gemini’s AI Agents Accelerated Chrome’s Bug Hunt Google’s internal security team integrated Gemini, the company’s latest large‑language‑model platform, into its vulnerability‑scanning pipeline. The AI agents performed three core tasks: Automated code analysis – By ingesting Chrome’s massive codebase, the models flagged risky patterns, unsafe API calls, and legacy modules that often hide bugs. Prioritization and risk scoring – Gemini assigned a severity score to each finding, allowing engineers to focus on exploits with the highest potential impact. Patch drafting assistance – For many low‑complexity issues, the AI generated candidate code changes, which senior engineers then reviewed and merged. The system worked in a loop: the AI scanned, reported, received feedback, and refined its heuristics. This iterative approach cut the average time‑to‑detect from weeks to hours and reduced manual triage effort by an estimated 40 %. The Scale and Impact of Fixing 1,072 Vulnerabilities During the 60‑day sprint, the AI‑augmented process uncovered 1,072 distinct security bugs across Chrome’s rendering engine, JavaScript runtime, and networking stack. Roughly half were classified as “high‑severity,” meaning they could have enabled remote code execution or data exfiltration. Key outcomes include: Reduced exposure window – The median time between bug discovery and patch release dropped from 45 days (historical average) to under 7 days. Broad coverage – The AI identifie

This article was originally published on e-shikumi-labo . Hello, I'm Shin from e-Shikumi-Labo. This is the final installment (Part 4) of "Systematized Thinking," where we use AI to build our own tools and independently maintain them. So far, we have discussed creating a prototype that automatically saves Gemini chat logs, converting them to Markdown for Obsidian integration, and elevating it to a safe, fully automated system. In this final installment, we will cover the "countermeasures for downtime due to screen specification changes," an unavoidable issue when operating tools that handle web data, and the core of the "self-reliance" humans should possess in the AI era. 1. The Web Data Extraction Compromise: "You Can't Extract What Isn't on the Screen" During development, there was a time when I thought, "I also want to record the exact date and time (timestamp) when the chat was sent." However, no matter how much I analyzed Gemini's screen structure, the exact timestamp of each utterance did not exist in the HTML. The fundamental rule of web data extraction is: "You cannot extract data that does not exist on the browser screen." As long as you are extracting data from the screen (DOM) rather than via an API, forcing the extraction of something that isn't there will require complex guesswork processes and will instead become a cause of trouble. Understanding this "technical limit," gracefully giving up on what cannot be done, and judging to maintain simplicity is also an important element of tool building. 2. Specification Changes Are Not Defects, But "Fate" As long as you deal with tools that extract data from other people's websites, the time will inevitably come when the tool suddenly stops working one day due to design changes or updates on Google's side. "It was working fine until yesterday, but suddenly it stopped saving." This is not a defect in the tool, but an unavoidable "fate" as long as you depend on someone else's platform. The important thing is not t

This article was originally published on e-shikumi-labo . Hello, I'm Shin from e-Shikumi-Labo. This is Part 3 of "Systematized Thinking," where we use AI to build our own tools and independently maintain them. Last time, I talked about creating a system to automatically output Markdown (.md) files to Google Drive simultaneously with appending to a spreadsheet. With list management in a spreadsheet and a comfortable viewing environment in Obsidian established, it was getting very close to completion as a tool. However, as I continued to use it practically, new challenges emerged on the operational front. This time, I will share the risks I faced while transitioning from a "manual button" to "full automation," and the process of evolving into safe code. 1. I Want to Eliminate the "Hassle of Pressing a Button" During the prototype stage, the system was designed so that logs were saved by pressing a button placed on the screen. However, as long as a human operates it manually, there are inevitably limitations. If you are concentrating on the conversation, you might forget to press the save button and close the screen. If the conversation gets long, you might miss past utterances that are no longer displayed on the screen. "If I have the screen open and am conversing, I want it to automatically save in the background without bothering human hands." Thinking this, I asked the AI to write the code for full automation. 2. The Code the AI Produced: "Patrolling the Screen Every 1.5 Seconds" When I consulted the AI, it immediately presented code for full automation. The mechanism was, "Start a timer every 1.5 seconds, check the entire screen in the background, and send any new utterances." When I actually tried it, the logs accumulated automatically as soon as I conversed without pressing the button, and at first glance, it looked like exceptionally well-done full automation. However, I felt something was slightly off regarding this "monitoring on a 1.5-second cycle." 3. The B

The last two versions of Chrome have included more patches than the previous 23 combined.

As experts have warned for the last two years, some companies — like Microsoft and now Google — are finding and patching an exponential number of bugs in their products, thanks to the use of LLMs and AI tools.

The two Chrome updates in June patched more bugs than the 23 updates before them. Now, Google is ramping up its patching schedule thanks to AI-assisted vulnerability discovery.

Google is working on a way to apply Chrome updates without requiring you to restart your browser. In a post on Thursday, Google outlines its approach to bug fixes in the age of AI, while noting that it's trying to make updates less disruptive by "investing in 'dynamic patching' that will eliminate the need for […]

Most "save this for later" tools I've used eventually want a server: an account system, a database for your notes, a sync service with its own outage history. I wanted something narrower — capture text or a whole page while browsing, turn it into a spaced-repetition flashcard, and have it show up on my other machine — without running any infrastructure at all. MindStack is a Manifest V3 Chrome extension that does exactly that: capture, spaced-repetition scheduling, a full dashboard, and cross-device sync, built entirely on chrome.storage.sync and chrome.identity . No backend, no bundler, no npm install before you can load it unpacked. Here's what that constraint forces you to get right. Decision 1: The scheduler is SM-2-shaped, not SM-2 Spaced repetition apps usually reach for a full SuperMemo SM-2 implementation — ease factors computed from response quality on a 0–5 scale, per-review interval history. MindStack's actual scheduler is a compressed version that captures the two properties that matter for a lightweight capture tool and drops the rest: const scoreReview = async ( score ) => { const memory = state . memories . find (( item ) => item . id === activeReviewId ); const interval = { forgot : 1 , hard : Math . max ( 1 , Math . round (( memory . reviewCount || 1 ) * 1.5 )), good : Math . max ( 2 , Math . round (( memory . reviewCount || 1 ) * ( memory . ease || 2.5 ))), easy : Math . max ( 4 , Math . round (( memory . reviewCount || 1 ) * (( memory . ease || 2.5 ) + 1 ))) }[ score ]; const updated = { ... memory , reviewCount : ( memory . reviewCount || 0 ) + 1 , successCount : ( memory . successCount || 0 ) + ( score === " forgot " ? 0 : 1 ), ease : Math . min ( 3.4 , Math . max ( 1.3 , ( memory . ease || 2.5 ) + ({ forgot : - 0.35 , hard : - 0.12 , good : 0.05 , easy : 0.16 }[ score ]) )), nextReviewAt : addDays ( interval ), }; Two properties, deliberately preserved from SM-2: intervals grow multiplicatively with review count (so a card you keep getting righ

Chrome still ships no dark mode for its built-in PDF viewer. Open a white paper at 1am and you get a flashbang. So you go to the Web Store, install the extension with the most installs, click it, and… nothing happens. The page stays white. I went and read the manifests of the top results to find out why. Two reasons, and both are boring. Reason 1: the popular ones only handle file:// The extension named "PDF Dark Mode" (about 10,000 users, rated 2.5) declares exactly this: "permissions" : [ "scripting" , "declarativeContent" ] , "host_permissions" : [ "file:///*.pdf" ] The runner-up, "PDF Dark Theme" (about 9,000 users, rated 2.9), does the same thing with a content script: "content_scripts" : [{ "matches" : [ "file://*.pdf" ], "js" : [ "content-script.js" ] }] file:///*.pdf matches a PDF you dragged in from your own disk. It does not match https://arxiv.org/pdf/1706.03762 , or the invoice your bank linked, or the syllabus on a course site. That is where almost everyone actually meets a PDF. So the extension is installed, enabled, and structurally incapable of touching the document in front of you. This is also why the reviews are full of people being told to flip "Allow access to file URLs" and reporting back that it changed nothing. It was never the missing piece. You can check any extension for this in ten seconds: chrome://extensions → Details → look at "Site access". If it says nothing beyond file URLs, that is your answer. Reason 2: the CSS target moved The other approach is a CSS filter on the viewer element: embed [ type = "application/x-google-chrome-pdf" ] { filter : invert ( 90% ) hue-rotate ( 180deg ); } That used to be right. When you navigate straight to a PDF today, the document you are styling has no <embed> in it. The viewer lives in an out-of-process child frame that your CSS cannot reach. Your selector matches zero elements and fails silently, which is the worst way for CSS to fail. What does reach it is a filter on the root element of the PDF doc

Most Chromebooks ship with only 8GB of RAM, which is enough for some people, but certainly not enough for me. Multitaskers who want more memory in their next Chromebook should check out Best Buy, which is discounting Acer’s Chromebook Plus Spin 514 for the remainder of the day. Originally $749 for the configuration with 12GB […]

The feature was supposed to be the easy one. NotebookLM generates flashcards. My extension reads them...

I had a website blocker, a Pomodoro timer, a tab suspender, and a time tracker installed at the same time — four separate extensions, four separate settings pages, none of them talking to each other. Starting a focus session meant manually turning on the blocker, then starting the timer, and neither knew the other existed. So I built TabInsights , which does all four and actually connects them. What it does Website blocker — block by domain, category, or schedule, with an optional typed "unblock challenge" for the days willpower isn't enough. Pomodoro focus timer — one click starts a 15/25/45-minute sprint, which also auto-blocks distracting categories for the duration and unblocks them automatically when it ends. This is the part that actually solves my original problem — the timer and the blocker are the same feature, not two extensions coincidentally running at once. Memory saver — auto-suspends tabs you haven't touched in a configurable window (15–60 min), freeing roughly 50MB of RAM each via chrome.tabs.discard() . Suspended tabs stay in your tab bar and reload exactly where you left off with one click. Automatic time tracking — logs time per domain with no manual start/stop, and shows a daily focus score. A few implementation notes Manifest V3 removed persistent background pages, which meant every "ongoing" feature — sprint timers, the daily summary, auto-suspend checks, license re-validation — had to be rebuilt on chrome.alarms instead of a long-lived timer. The gotcha: Chrome clamps alarm intervals to a minimum of 1 minute in packaged (published) extensions, so anything needing finer granularity has to accept that floor rather than fight it. The blocker uses declarativeNetRequest — you hand Chrome a set of match rules and it enforces them at the browser level. The extension never actually reads the blocked request; it can't, by design, which is also the honest answer any time someone asks whether a blocker "sees" their browsing. The bigger architectural deci

In my last post I said that for normal HTML pages, element-based automation ( find / read_page ) beats coordinates every time. This post is about the apps where that advice is useless. Flutter Web apps. Canvas-rendered editors. Every button and panel you can see on screen doesn't exist in the DOM — it's all pixels painted onto a single canvas. find returns nothing. read_page 's accessibility tree is effectively empty. I got Claude to drive the Rive editor (an animation tool built with Flutter) all the way through selecting assets and exporting them. Here's the procedure that survived contact with reality. Step zero: confirm you're actually in this situation Coordinate automation is fragile, so you should only accept it after ruling out the alternative. The test is quick: run read_page . If the visible UI has almost no corresponding nodes, you're looking at a canvas-rendered app, and coordinates are the only interface you have. The four rules 1. Wait for the window size to settle before anything else Same failure mode as my previous post: right after load, the viewport hasn't reached its final width (I measured 1664→1920 over 2–3 seconds), and clicks based on an early screenshot land to the right of the target. Read innerWidth via javascript_tool twice; only proceed when two consecutive reads match. But matching innerWidth alone isn't enough — also confirm devicePixelRatio hasn't changed since the screenshot you're about to act on (a follow-up to my previous post surfaced this: when DPI or scaling changes, the whole coordinate space rescales the same way, but the new values stabilize immediately, so an innerWidth -only check can't catch it). Canvas apps deserve extra paranoia here, because there is no element-based fallback when a click misses. 2. Read text by zooming, not by extracting Text painted on canvas can't be pulled out of the DOM. To read a menu item or panel label, zoom into that region and read the enlarged screenshot as an image. Full-page screenshots ma