Non-persistent background scripts used where possible
Why it matters
A persistent MV2 background script runs continuously from browser launch to shutdown, consuming memory and CPU even when the extension is idle. ISO 25010 performance-efficiency requirements apply: a component that holds resources it does not need is inefficient by definition. Chrome's MV3 mandate migrates all extensions to service workers precisely to eliminate persistent background scripts. Beyond resource consumption, persistent background scripts accumulate state across long sessions, which creates subtle bugs when extension logic assumes a clean startup context. Chrome Web Store's MV3 timeline treats persistent: true in MV2 as a technical debt marker that blocks long-term store access.
Severity rationale
Info because persistent background scripts are a performance and architectural concern rather than a direct security vulnerability, but they indicate non-compliance with Chrome's MV3 roadmap requirements.
Remediation
Migrate to MV3 with a service_worker background in manifest.json. Service workers are non-persistent by design and restart on demand.
{
"manifest_version": 3,
"background": {
"service_worker": "background.js"
}
}
If you must stay on MV2 temporarily, set persistent: false in the background configuration. Rewrite long-running logic to use chrome.alarms instead of setInterval — alarms persist across service worker restarts.
DetectionPro
The detection method for this pattern is part of AuditBuffet Pro.
The full method (what to look for, pass and fail conditions, and how results get reported) ships inside the Extension Permissions & Security Audit. The pattern definition, severity rationale, and remediation remain openly licensed under CC-BY-4.0.
External references
- iso-25010:2011 · performance-efficiency.resource-utilization — Performance Efficiency — resource utilization
- external · chrome-service-worker — Chrome Extensions MV3: Service Worker (Non-Persistent Background)
Taxons
History
- 2026-04-18·v1.0.0·Initial import from extension-permissions-security·automated