>
    Strata Copilot
    Extension Force Install
    Focus
    Download PDF
    Focus
    1. Home
    2. Prisma Browser
    3. Manage Prisma Browser Control Sets
    4. Configure Prisma Browser Customization Controls
    5. Configure Customization
    6. Extension Force Install
    Download PDF
    Prisma Browser

    Extension Force Install

    Table of Contents

    Extension Force Install

    Extension Force Install control
    Prisma Browser DesktopPrisma Browser ExtensionPrisma Browser for Mobile
    Full supportNo support No support
    This feature allows you to configure specific extensions that are to be installed automatically in the Prisma Browser.
    If there are multiple rules that have the Extension Force Install control applied, all the applicable extensions will be installed.
    1. From Strata Cloud Manager, select ConfigurationPolicyControl SetsBrowser CustomizationCustomization
    2. Select Extension Force Install.
    3. Click Add Extension.
    4. Select the Store that is the source of the extension. The options are:
      • Chrome Web Store.
      • Custom URL. Enter the URL.
    5. Select whether the extension will be pinned to the toolbar for the end users.
    6. Select whether the extension will be automatically installed in Incognito mode.
    7. If applicable, enter the Custom Configuration.
      The system supports JSON format. Custom configuration depends on your extension vendor; contact your vendor or support partner for assistance.
    8. Click Add.

    Self-hosting Chrome Extensions

    This guide explains how to package, host, and update custom .crx extension files on your own web server.
    Note: If you plan to publish or distribute your extension solely through the Chrome Web Store, refer to the official Chrome Web Store hosting and updating documentation instead.

    1: Packaging Your Extension

    Chrome extensions and themes are distributed as compressed .crx files. To host an extension on your own server, you must either obtain a signed package from the Developer Dashboard or package the source code locally.
    Option A: Downloading from the Chrome Web Store
    If your extension is already uploaded to the Web Store, downloading the signed package is the most secure approach, as Google signs the contents to guard against tampering.
    1. Log in to the Chrome Developer Dashboard.
    2. Locate your extension under Your Listings and click More info.
    3. In the pop-up window, click the main.crx link to download the file, then transfer it to your server.
    Option B: Packaging Locally via Chrome UI
    1. Navigate to chrome://extensions/ in Chrome, or select Menu → More Tools → Extensions.
    2. Enable Developer Mode in the top-right corner.
    3. Click Pack Extension and enter the directory path of your unpacked extension.
    4. Click Pack Extension. (Leave the private key field blank for initial packaging).
    Chrome generates two output files:
    • A .c file containing the application package.
    • A .pem file containing the extension's private key.
    Keep the generated .pem private key in a secure location. You will need this key to sign future version updates.
    Option C: Packaging via Command Line
    Automate packaging by invoking Chrome from the command line with the appropriate flags: 
    chrome --pack-extension=/path/to/extension 
--pack-extension-key=/path/to/key.pem
    Updating a .crx Package
    To release an update, increment the version number in manifest.json: 
     manife//st.json
{
  "name": "My Extension",
  "version": "1.6"
}
    Repackage the directory by supplying both the source path and your existing .pem private key in the Pack Extension dialog or command line.

    2. Server Configuration & Hosting

    To allow browser installation via direct link clicks, your web server must serve .crx files with supported HTTP headers.
    Chrome allows installation when either of the following conditions is satisfied:
    • The response header specifies Content-Type: application/x-chrome-extension.
    • The file extension is .crx AND both conditions below are met:
      • The header X-Content-Type-Options: nosniff is not present.
      • The file is served with a generic content type (e.g., text/plain, application/octet-stream, or an empty string).
      Installation failures are typically caused by the presence of the nosniff header or unrecognized content-type definitions.

    3. Configuring Automated Updates

    Chrome periodically polls host servers for extension updates using an XML update manifest. If the manifest specifies a newer version, the browser automatically downloads and installs it (provided it is signed with the same private key).

    Step 1: Declare the Update URL

    Add the update_url property to your extension's manifest.json: 
    {
  "name": "My Extension",
  "update_url": "https://myhost.com/mytestextension/updates.xml"
}

    Step 2: Create the XML Update Manifest

    Host an XML document formatted according to Google's Omaha protocol at your specified update URL: 
    <?xml version='1.0' encoding='UTF-8'?>
<gupdate xmlns='http://www.google.com/update2/response' 
protocol='2.0'>
  <app appid='aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa'>
    <updatecheck 
codebase='https://myhost.com/mytestextension/mte_v2.crx' version='2.0' />
  </app>
</gupdate>
    Key XML Attributes:
    • appid: The unique extension ID displayed on chrome://extensions/.
    • codebase: The secure HTTPS URL where the target .crx package is hosted.
    • version: Target package version (must match manifest.json inside the package).

    Restricting Updates by Browser Version

    If an update requires a specific Chrome version, append prodversionmin to the <updatecheck> tag:
    <updatecheck codebase='https://myhost.com/extension_v2.crx' 
version='2.0' prodversionmin='3.0.193.0'/>

    Dynamic Server-Side Updates

    For hosting multiple extensions, you can use dynamic scripts to generate update XML responses based on request parameters passed by Chrome: 
    https://test.com/update.php?x=id%3Daaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
%26v%3D1.1

    Testing Updates

    To trigger an immediate update check without waiting for the automated background process, open chrome://extensions/ and click Update extensions now.

    © 2026 Palo Alto Networks, Inc. All rights reserved.