From a279db37da7ccae7ae7915ee1b6c07b24c649f28 Mon Sep 17 00:00:00 2001
From: Eva Su <evasu@chromium.org>
Date: Tue, 15 Sep 2026 10:11:44 -0700
Subject: [PATCH] [Extensions] Add policy and API override warning to site access settings

Site access settings can be overridden by enterprise policies or
powerful APIs. crbug.com/517148875 highlighted that extensions that use
the debugger API can bypass site access settings. Rather than block
this, we want to make a UI change to inform users that the access
settings can be overridden in these cases.

Screenshot: https://screenshot-v2.corp.google.com/1h1midf9rhi3o

Fixed: 517148875
Change-Id: I4b1f2ae7d37dc1841d47ec111e620c984107dba3
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8407988
Reviewed-by: Devlin Cronin <rdevlin.cronin@chromium.org>
Commit-Queue: Eva Su <evasu@chromium.org>
Cr-Commit-Position: refs/heads/main@{#1698219}
---
diff --git a/chrome/app/extensions_strings.grdp b/chrome/app/extensions_strings.grdp
index ef5434a..338e9305 100644
--- a/chrome/app/extensions_strings.grdp
+++ b/chrome/app/extensions_strings.grdp
@@ -160,6 +160,9 @@
   <message name="IDS_EXTENSIONS_HOST_PERMISSIONS_SUB_HEADING" desc="The heading above the details of which websites an extension is allowed to run on, for the new site access settings.">
     You can always click the extension to use it on any site
   </message>
+  <message name="IDS_EXTENSIONS_HOST_PERMISSIONS_OVERRIDE_WARNING" desc="Warning text shown in the extension details page informing that site access settings can be overridden.">
+    Note: These site access settings may be overridden by enterprise policies or powerful APIs.
+  </message>
   <message name="IDS_EXTENSIONS_HOST_ACCESS_ON_CLICK" desc="The text for the option to only allow an extension to read and change data when the user clicks on the extension.">
     On click
   </message>
diff --git a/chrome/app/extensions_strings_grdp/IDS_EXTENSIONS_HOST_PERMISSIONS_OVERRIDE_WARNING.png.sha1 b/chrome/app/extensions_strings_grdp/IDS_EXTENSIONS_HOST_PERMISSIONS_OVERRIDE_WARNING.png.sha1
new file mode 100644
index 0000000..383927d
--- /dev/null
+++ b/chrome/app/extensions_strings_grdp/IDS_EXTENSIONS_HOST_PERMISSIONS_OVERRIDE_WARNING.png.sha1
@@ -0,0 +1 @@
+8c6523a21264b0ee7af70c33ca8821f9aa0adbba
\ No newline at end of file
diff --git a/chrome/browser/resources/extensions/runtime_host_permissions.css b/chrome/browser/resources/extensions/runtime_host_permissions.css
index d5457c1..c0c12de 100644
--- a/chrome/browser/resources/extensions/runtime_host_permissions.css
+++ b/chrome/browser/resources/extensions/runtime_host_permissions.css
@@ -90,6 +90,11 @@
   margin-top: 3px;
 }
 
+#new-section-heading-override-warning {
+  color: var(--cr-secondary-text-color);
+  margin-top: 3px;
+}
+
 #host-access-row {
   display: flex;
   justify-content: space-between;
diff --git a/chrome/browser/resources/extensions/runtime_host_permissions.html.ts b/chrome/browser/resources/extensions/runtime_host_permissions.html.ts
index 69937c0..2aa96fb 100644
--- a/chrome/browser/resources/extensions/runtime_host_permissions.html.ts
+++ b/chrome/browser/resources/extensions/runtime_host_permissions.html.ts
@@ -68,6 +68,9 @@
       <span id="new-section-heading-subtext">
         $i18n{hostPermissionsSubHeading}
       </span>
+      <span id="new-section-heading-override-warning">
+        $i18n{hostPermissionsOverrideWarning}
+      </span>
       <div id="host-access-row">
         <select id="newHostAccess" class="md-select"
             @change="${this.onHostAccessChange_}"
diff --git a/chrome/browser/ui/webui/extensions/extensions_ui.cc b/chrome/browser/ui/webui/extensions/extensions_ui.cc
index 68db74e..0513e23 100644
--- a/chrome/browser/ui/webui/extensions/extensions_ui.cc
+++ b/chrome/browser/ui/webui/extensions/extensions_ui.cc
@@ -159,6 +159,8 @@
        IDS_EXTENSIONS_NEW_HOST_PERMISSIONS_HEADING},
       {"hostPermissionsSubHeading",
        IDS_EXTENSIONS_HOST_PERMISSIONS_SUB_HEADING},
+      {"hostPermissionsOverrideWarning",
+       IDS_EXTENSIONS_HOST_PERMISSIONS_OVERRIDE_WARNING},
       {"hostAccessAskOnEveryVisit",
        IDS_EXTENSIONS_HOST_ACCESS_ASK_ON_EVERY_VISIT},
       {"hostAccessOnClick", IDS_EXTENSIONS_HOST_ACCESS_ON_CLICK},