I'm developing a Chrome extension that absolutely cannot be detected by a particular site.
Just checking, that in 2020, there is no method for a site to detect an extension if I am not injecting any DOM/JS/content into the page, and web_accessible_resources is not defined in manifest.json.
As far as I can tell Chrome is logging the 'Denying load of ...' error directly to DevTools console, bypassing the console.* api
Test code to see if I can hook the 'Denying load of..' error that fetch triggered - looks like you can't.
<script>
const clog = console.log
console.log = function(x) {
clog('x: ',x)
}
const cerror = console.error
console.error = function(x) {
cerror('error: ',x)
}
window.fetch('chrome-extension://jifpbeccnghkjeaalbbjmodiffmgedin/options.js',{method: 'get'})
.then(response => response.text()).then(body => console.log(body))
.catch(err => console.log(err))
</script>
I think the policy code use of frame->addMessageToConsole bypasses the console.* API
if (!is_empty_origin && !is_own_resource &&
!is_dev_tools && !transition_allowed && !is_error_page) {
std::string message = base::StringPrintf(
"Denying load of %s. Resources must be listed in the "
"web_accessible_resources manifest key in order to be loaded by "
"pages outside the extension.",
resource_url.spec().c_str());
frame->addMessageToConsole(
blink::WebConsoleMessage(blink::WebConsoleMessage::LevelError,
blink::WebString::fromUTF8(message)));
return false;
}