Manifest-V3

Chrome extensions live in a weird middle ground. They’re not normal web pages, but they’re not fully trusted native apps either. That matters a lot for CORS. If you build extensions long enough, you hit this fast: fetch() works in your background service worker the same request fails in a content script adding Access-Control-Allow-Origin to your request does nothing people tell you to “just use host_permissions” and then preflights still surprise you The mental model that has saved me the most time is this: ...

CORS in Microsoft Edge extensions trips people up because extensions are not normal web pages, but they’re also not completely exempt from browser security rules. I’ve seen teams waste hours debugging a “CORS issue” that was actually a host permission problem, a content script limitation, or a server sending the wrong headers. If you build Edge extensions, you need to separate three execution contexts in your head: Content scripts Extension pages like popup, options, side panel Background/service worker That distinction explains most CORS bugs. ...