Google Chrome Extension Package MIME Type

What does application/x-google-chrome-extension mean?

The application/x-google-chrome-extension media type identifies a packaged Chromium extension, normally stored in a .crx file. A CRX package combines a signed header with a ZIP archive containing the extension's manifest.json, JavaScript, HTML, CSS, images, and other resources.¹

This exact media type is an unregistered convention. It does not appear in IANA's application media-type registry.² Chrome's own documentation and source use application/x-chrome-extension instead.³⁴ Poly maps the .crx extension to application/x-google-chrome-extension, so that is the identifier documented on this page.

Where did CRX come from?

Google developed CRX for Chrome's extension system. Chromium documentation discussed repackaging extensions by June 2009, and Google launched Chrome extensions in beta for Windows and Linux on December 8, 2009.⁵⁶ This page therefore uses 2009 as the format's origin year, not as an IANA registration date.

The format has evolved. Older CRX2 packages and current CRX3 packages share the opening Cr24 signature, but their signed headers differ. Chromium's CRX3 description is maintained directly in the source tree and identifies format version 3 as the current layout.¹

How do you identify a CRX file?

A CRX file begins with four ASCII bytes spelling Cr24, which are 43 72 32 34 in hexadecimal. The next four bytes are a little-endian format version.¹⁴

For CRX3, the version is followed by a four-byte header length, the encoded header, and then the ZIP archive. The header can carry RSA or ECDSA proofs, signed data containing the extension ID, and verified-contents information.¹ Chromium verifies signatures over the signed header and archive rather than trusting the filename or magic bytes alone.⁷

How do you open or install a .crx file?

Chrome, Edge, and Opera understand CRX packages, but support does not mean that any website can silently install one.

• Chrome packages extensions from chrome://extensions. Direct installation is normally limited to Chrome Web Store packages, managed environments, and supported Linux self-hosting flows.³⁸
• Microsoft Edge can create and load CRX packages from edge://extensions. Self-hosted deployment is controlled by enterprise requirements and extension policies.⁹
• Opera documents support for Chromium's CRX format when the extension uses APIs that Opera implements.¹⁰

Firefox and Safari use different extension packaging and distribution systems. A .crx file is not a portable browser-extension package for every browser.

For source inspection, use an extension-development tool or CRX-aware extractor that understands the signed prefix before the ZIP payload. Do not edit a downloaded package in place and expect its signature to remain valid. Chrome can also load a trusted extension directory in developer mode, which is more practical when you control the source.

Support in Poly

Poly recognizes .crx filenames as application/x-google-chrome-extension and classifies them as archives. It can store, sync, share, version, download, and find the outer package by name.

Poly treats the CRX payload as opaque:

• It does not verify the CRX signature or extract the embedded ZIP archive.
• It does not index manifest.json, member filenames, permissions, or source code.
• It does not generate a content thumbnail or provide an in-app package preview.
• The Poly agent cannot read or analyze files inside the package.

Download a CRX and inspect it with trusted CRX-aware tooling when you need the extension contents. If you add the extracted text files to Poly separately, they can use Poly's normal text indexing and preview path.

Is CRX just a ZIP file?

Not quite. The package ends with a ZIP archive, but CRX adds a versioned, signed header before it.¹ Some ZIP tools tolerate data before the first ZIP record and may list the payload, while others reject it. Renaming extension.crx to extension.zip is therefore not a reliable conversion method, and it discards the distinction between a signed browser package and an ordinary archive.

Chrome's packaging flow creates both a .crx package and a .pem private key. The same private key is needed when repacking an update so that the extension retains its identity.³

Security and privacy considerations

A valid signature establishes a relationship to a signing key and helps detect tampering. It does not establish that the extension is harmless. Review the requested permissions, host access, background behavior, update URL, and included code before trusting a package.

Keep a developer .pem key secret. Someone who obtains it may be able to sign an update that keeps the same extension identity. Chrome's documentation explicitly warns not to lose or disclose the key.³

Installation restrictions are part of the security model. Chrome states that only extensions hosted and signed by the Chrome Web Store can be installed directly by ordinary users, with self-hosting reserved for managed environments and a limited Linux path.⁸ Edge likewise places self-hosted installation behind platform and policy requirements.⁹ Bypassing those controls to install an unknown CRX removes useful provenance and review signals.

When auditing an extracted package, remember that important behavior can be fetched at runtime or activated only on particular sites. Static inspection is useful, but it is not a complete behavioral analysis. Test untrusted extensions only in an isolated browser profile or disposable environment with no sensitive accounts or data.

Why do two MIME types appear for CRX?

application/x-google-chrome-extension and application/x-chrome-extension are not separately versioned CRX formats. They are competing unregistered labels for the same general file family. The bytes inside the file, especially the numeric value following Cr24, determine whether the package uses CRX2 or CRX3.

For file organization in Poly, use application/x-google-chrome-extension. For an HTTP response intended for Chrome's CRX hosting flow, follow Chrome's documentation and use application/x-chrome-extension.³ When interoperability matters, also preserve the .crx filename and verify the package structure rather than relying on either MIME label alone.