Chrome Fix: Extensions, apps, and user scripts cannot be installed from this web site

On Google Chrome Canary, I have lately been getting the Extensions, apps, and user scripts cannot be installed from this web site error message when I was trying to install a userscript from userscripts.org, or an extension from a third party website. No matter what I did, it always displayed the Install Failure dialog and blocked the extension, app or userscript installation.

Update: The message has changed a bit. Chrome displays "Apps, extensions and user scripts cannot be added from this website" when you try to do so in newer versions of the browser

I first tried to download the file to the local PC first, to drag and drop it into the browser window to run a local installation, but that too was blocked by the web browser.

I have tested this in Chrome 19 and the browser did not block the installation, suggesting that only users of Chrome Canary, and maybe Dev, are currently experiencing the issue.

It needs to be noted though that this has been implemented on purpose by the Chromium team, and that users who run stable or beta versions of the browser will eventually run into the same issues that Canary users are currently experiencing.

Why was it implemented

Off-store installations of extensions have been taken away mainly to protect the browser's user base from malicious extensions. It is one of those decisions that protects the clueless by punishing users who know what they are doing. Instead of switching off-site installations off by default, but providing users with the means to enable the feature again, Google decided to go all in and disable off-site extension installation completely.

According to one developer comment, the company overlooked popular user scripts in the implementation and has prepared a fix to resolve the issue.

This change was made to protect users. Off-store extensions have become a popular
attack vector for compromising users of larger sites (e.g. Facebook). Since the trend is only getting worse, we're putting the power back in the user's hands by allowing them to control where extensions are installed from. By default, the Chrome Webstore is the only source, but users and administrators will be able to add other safe sources as they see fit.

There you have it. Chrome users by default can only install extensions from the Chrome Web Store and no other location. Currently there is no option to add other "safe sources" to the browser, but it looks as if the team will implement the feature in a later version of the browser.

It will also be interesting if the browser will block extension installations from software installations, e.g. security software or toolbar installations, or if they will go through regardless of that.

Workaround

A workaround has been created, but it is not pretty. To bypass the protection, you need to download the extension or userscript to the local system. Once there, you need to drag and drop it into the chrome://chrome/extensions/ page in the browser. If you drag and drop it elsewhere, nothing will happen.

When you drop it on the extensions page, you will notice an install option popping up there.

When you select that option, you will see the standard installation dialog that informs you about the rights that the script or extension is requesting.

Closing Words

I personally dislike the feature, and wish that the developers would add an on or off switch to it. I would not have an issue with it being set to off by default, if it would not be a issue to enable it again. As it stands now, it is making the life of extension developers and advanced users more complicated.

Update

A start-up parameter is making the rounds that you can use alternatively to enable off-site installations in the Chrome browser. For that, you need to start Chrome with the --enable-easy-off-store-extension-install parameter. Let me show you how you add that parameter to Chrome under Windows 7. If you have Chrome in your Taskbar right-click, hover the mouse over the Google Chrome entry there, and select Properties from the context menu.

If you are in the start menu, right-click on the Chrome link and select Properties directly. Append the command that you see above - with two dashes - to the end of the Target line there and save the settings with a click on ok.

When you start Chrome now you should be able to install extensions and userscripts from third party sites as well.

System administrators can set urls that are allowed to install extensions, themes and scripts in Chrome using the ExtensionInstallSources Policy.

Advertisement