The Chrome Web Store rejects extensions with a Purple Potassium tag, which creates confusion for developers because their extension appears safe. The code clearly shows that your extension asks for permissions which exceed what it requires to operate.
Permissions function as a powerful tool. The extension's access permissions determine which resources it can reach, including user tabs, and browsing history, as well as protected storage and data. The Chrome review team identifies security and privacy threats when a manifest.json file contains more permissions than needed or contains unnecessary permissions.
Note: ‘Purple Potassium’ is an internal term used in Chrome’s review process to indicate metadata or listing quality issues — not a public rejection label.
The rejection carries specific reasons which we will analyse to determine its causes. We will discover solutions that do not require extension rewriting.
Chrome Web Store uses Purple Potassium to indicate permissions that are excessive, not utilized, or unnecessary within your manifest.json file. These could involve needing or requesting access to a feature that isn't part of your extension's core functionality, requesting an API that isn't required, or having host permissions that are overly broad (like all_urls).
The Chrome Review process uses the principle of least privilege it applies both to declared permissions in manifest.json and runtime requests via chrome.permissions.request(), so your extension should only request what is needed to function.
If you have been hit by code Purple Potassium, here are the most common culprits:
A clear way to remove unnecessary items from your manifest and pass the review:
chrome.permissions.request() and revoked using chrome.permissions.remove().Note: privacy policies are mandatory if any permission grants access to user data (like history, cookies, or downloads).
Note: permissions declared but only commented out in the code still count as requested — Chrome checks the manifest, not code comments.
Prior to hitting that “Submit for Review” button, take a quick look at this QA list:
A simple 10-minute review like this can prevent days of rejection loops.
Purple Potassium rejections serve as reminders for all developers to respect user data boundaries. When your extension requests only what it truly needs, you will speed up the review process as well as earn user trust and build a reputation Don't let permission overuse slow down your approval.
Use Coditude's professional Chrome Extension QA checklist to find unused permissions, verify your manifest, and simplify your next submission. Stay compliant, stay approved and keep your extension lightweight, secure, and easy to use.