Purple Potassium is the internal name Chrome Web Store review
uses for a rejection about excessive or unused permissions in
manifest.json. Google's own troubleshooting documentation calls
requesting a permission you don't actually need the single most common
rejection reason for the platform. It applies to both the named API
permissions in permissions/optional_permissions and
to broad host_permissions patterns like <all_urls>.
A reviewer -- or an automated pre-check -- compares your declared permissions against what your extension's code and UI actually appear to do, and cannot find a feature that needs one of them. This is easy to trigger by accident: a permission left over from a removed feature, one copied from a tutorial or boilerplate, or one requested "just in case" for a feature not yet built.
| Shape | What it means | Cost |
|---|---|---|
| Declared, not used | A permission sits in the manifest with no matching chrome.* call anywhere | Review rejection (Purple Potassium) |
| Used, not declared | Code calls a chrome.* API whose permission was never added to the manifest | Runtime failure -- the call throws or silently no-ops, independent of review |
The checker on this site scans your source for the
namespace each permission unlocks (chrome.storage for
storage, chrome.tabs for tabs, and
more than 40 others), reads your manifest, and reports both directions --
declared-but-unused and used-but-undeclared -- plus any broad
host_permissions pattern, with the exact file and line for
every match it can find. It runs as a browser tool (nothing uploaded) or a
Node CLI you can add to your own pre-submission check.
This is evidence of what the code and the manifest say, not a determination that Chrome Web Store review will pass -- see the checker and its disclaimer for what it can and can't see (bundled third-party library code and dynamic imports in particular), and verify against Chrome's current documentation before you resubmit.