v155 · extensions · live probe

What can a web page see?

The policy this feature enforces governs an extension API. So what does the page being debugged get to know? Almost nothing — by design. Every probe on this page runs for real, right here, and the one thing that is genuinely not page-detectable is labelled exactly that.

Real probes, this page, right now

typeof chrome (page context)
—
chrome.debugger
—
chrome.scripting
—
navigator.webdriver
—

The debugger; statement — a manual observation, not a detector

Folk wisdom says a page can "detect debugging" by timing a debugger; statement. Try it — the button really executes one. If DevTools is open, execution pauses until you resume, and the elapsed time shows it. If DevTools is closed, the statement is a no-op — and an attached chrome.debugger extension session does not pause here either unless it explicitly enabled the Debugger domain and pauses. This is a manual observation about DevTools, not a chrome.debugger detector; treat any "anti-debugging" claim built on it accordingly.

Not run yet.

How attachment is actually disclosed

When an extension attaches, Chrome shows a browser-level infobar — "[Extension] started debugging this browser" — that the page can neither see, style, nor dismiss. Disclosure deliberately lives in trusted UI, outside the reach of the page (and of the attacker who controls the page). The Chrome 155 change tightens the other side of the same boundary: whether the extension may attach at all on a managed browser. Neither side consults the page.

There is no page-side event, property, or timing surface that reliably reveals a chrome.debugger attachment. That absence is the observation — this panel is honest documentation, not a probe pretending to succeed.

code path

// In PAGE context (this page — run the probes above):
typeof chrome            // "object" in Chrome (chrome.csi, loadTimes…)
typeof chrome.debugger   // "undefined" — extension APIs never reach pages
navigator.webdriver      // true only under WebDriver/headless automation —
                         // NOT set by chrome.debugger attachment

// In EXTENSION context (service worker with "debugger" permission):
typeof chrome.debugger   // "object" — attach/sendCommand/detach live here,
                         // and Chrome 155 policy-gates attach() up front

see also