Native Messaging Permission Explained

Native messaging permission explained

Short answer

The nativeMessaging permission lets an extension exchange messages with a native application installed on your computer, launched through a browser-configured host manifest. Because the native app runs outside the browser sandbox, this permission enables deep integrations such as password manager hooks, but it also creates a bridge between web content and desktop software. Verify which companion application the extension expects and whether the publisher explains why it is needed.

Drop an extension package hereor choose a file from your deviceChoose a fileSupported: CRX, XPI, ZIP, manifest.json. Maximum size: 25 MB.

Processed locallyCode is never executed

Your file stays in this browser. Parsing happens in a Web Worker; the extension code is read, never executed.

What the scan checks

Permissions, host access, content scripts, background scripts, CSP, externally_connectable, web-accessible resources, JavaScript patterns, referenced domains and risk categories.

MV3MV2CRXXPIZIPJSON

Static analysis shows references and patterns. It cannot prove that network activity happened or that an extension is malicious.

Compare two versions

See permission, domain and finding changes between two packages.

Compare

How native messaging works

An extension sends a message to a named native host. The browser looks up a JSON manifest installed on the operating system, launches the registered executable and pipes JSON messages between the extension and the program. The host manifest explicitly allows communication with specific extensions.

Because the native program runs with your user privileges, the permission can expose powerful desktop integrations that no ordinary API permission offers.

Native hosts are separate programs registered on your OS
Communication is JSON messages, not raw shell access
Developers install the host manifest outside the browser
One host manifest can allow specific extensions only

Why it deserves a closer look

The extension itself stays sandboxed, but the program it talks to does not. A compromised or lazy native host can turn messages into actions outside the browser, and the browser permission prompt says nothing about what that program does.

Legitimate users of nativeMessaging include password managers, antivirus plugins and enterprise device integrations. The capability is proportionate there because the companion software is the product.

How to verify the pairing

Read the manifest to confirm nativeMessaging is requested, then look in the code for the native host name it connects to. Check whether the publisher documents the companion application and whether that application is signed and distributed by the same publisher.

If an update changes or adds a native host name, treat it like a new endpoint: compare versions and read the release notes before accepting the change.

Find the nativeMessaging entry in manifest.json
Search the code for the host name string
Check the publisher's documentation for the companion app

Frequently asked questions

Does nativeMessaging give an extension shell access?

Not directly. The extension exchange JSON messages with the native host. What the host does with those messages depends on that program, outside the browser's control.

Why do password managers use native messaging?

To integrate with desktop applications, biometric prompts and system credential services. The companion program is part of the product, so the pairing is usually documented.

Can I use an extension with nativeMessaging safely?

Yes, if the companion application is trusted, signed and from the same publisher, and the feature genuinely needs desktop integration.

Last reviewed: November 4, 2026