I'm wondering if a chrome app I upload to the Chrome Webstore could potentially be manipulated (even by Google itself) without users downloading the app noticing it.

I just downloaded a packaged app to check if I can inspect its source code but it didn't allow me to. Is this true for all apps? If the source is hidden, how can I make sure that the app is in its original state?

Edit: I'm not asking about a chrome extension. I know that those can be signed.

2 Answers 2


The packages are signed, any modification of the package would cause the signature to be invalid.

Only you the app creator has access to the private key file so no other person could modify your file then re-sign it either. In fact if you loose your private key file you can't distribute updates to your extension because extensions will only update from packages signed with the same private key it was originally built with.

  • This answer is about extensions, but I was asking about packaged apps. There is no mention of code signing in Google's docs for publishing packaged apps: developer.chrome.com/webstore/publish
    – Nico
    Commented Feb 8, 2015 at 9:02
  • @Nico All app types have a manifest file. See the key attribute in the "Details: The manifest" on the hosted apps page. Commented Feb 8, 2015 at 16:23
  • I don't see any info about if that field can be used for packaged apps. developer.chrome.com/webstore/publish doesn't mention needing to generate a cert and crx file as with chrome extensions. I don't see any info from Google if code signing is supported for packaged apps. That's why I'm asking here.
    – Nico
    Commented Feb 8, 2015 at 18:43
  • Does anyone have any confirmation on this? Can packaged apps (NOT chrome extensions) be signed? Links?
    – Nico
    Commented Feb 14, 2015 at 12:06

Just to add, if you are using an SDK or third party libs, then those pieces can change and inject unwanted software in "your" app. That has been the recent case for some Android apps.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .