EG-MAN-018: Chrome update URL remains in Edge package

What ExtensionGate detects

When the Edge target profile is selected, this rule reads the root manifest and reports a non-empty update_url key. It shows the declared value without contacting it.

The same key is not automatically reported under the Chrome target profile because store-specific expectations differ.

Why it may matter

Microsoft's official Chrome-to-Edge porting guidance tells developers to remove update_url before packaging for Edge.

Keeping store-specific update configuration can produce incorrect update behavior or submission friction. Passing this rule does not prove broader Edge compatibility.

Synthetic failing example

{
  "name": "Synthetic Helper",
  "update_url": "https://clients2.google.com/service/update2/crx"
}

The synthetic Edge-targeted manifest retains Chrome Web Store update configuration.

Passing or legitimate example

{
  "manifest_version": 3,
  "name": "Synthetic Helper",
  "version": "1.2.0"
}

The Edge package omits update_url, matching Microsoft's porting instruction.

Remediation

1. Create or verify the Edge-specific build configuration.
2. Remove update_url from the Edge manifest output without changing the intended Chrome artifact.
3. Review Chrome branding, API support, listing, privacy, and certification notes.
4. Sideload and test the exact Edge ZIP in a clean Edge profile.

False-positive boundaries

• The rule runs only for an explicitly selected Edge scan profile.
• Enterprise or self-hosted distribution can have different update requirements and should be reviewed outside the public-store profile.
• A source manifest may legitimately contain the key if the Edge build removes it from the final ZIP.

What static analysis cannot determine

• The rule cannot prove Partner Center configuration or listing readiness.
• Chrome and Edge API compatibility must be tested at runtime.
• The scanner cannot know whether an artifact is intended for enterprise distribution unless the user selects the correct profile.

Official sources

• Microsoft: port a Chrome extension to Edge
• Microsoft: publish an Edge extension

Rule version history

Related guides

• Port a Chrome extension to Edge
• Microsoft Edge readiness