Swift A11y Get the tools

Swift A11y: a note for IT and security reviewers

Swift A11y is a set of fifteen accessibility testing tools for quality assurance testers and developers. It comes as a browser extension for Chrome, Edge and Firefox, and as bookmarklets. This note says what it can and cannot do, so a review can be done in one sitting. Every claim below can be checked against the source and the built files, and the last section says how.

In one paragraph

The extension asks for two permissions: activeTab and scripting. It does nothing until a person presses its toolbar button and chooses a tool. It then runs that one tool on that one tab. The tool reads the page and draws its results in a panel of its own. It sends nothing anywhere, stores nothing, and never shows, stores or copies what anyone has typed or chosen in a form. It has no background script, no content script that runs on every page, no host permissions, no remote code and no analytics.

Permissions

PermissionWhy it is neededWhat it allows, and what it does not
activeTabTo run a tool on the tab the person is looking at, when they ask.Access to the current tab only, only after the person presses the button, and only until that tab goes to another page. No access to other tabs, other windows or any site in the background.
scriptingTo put the chosen tool into that tab.Used with activeTab, so it reaches only the tab the person chose. The scripts it runs are the fifteen tool files inside the extension package, never code from the internet.

It does not ask for: host permissions (<all_urls> or any site), tabs, storage, cookies, history, downloads, webRequest, clipboardRead, debugger, nativeMessaging or any optional permission. Firefox's manifest declares that no data is collected (data_collection_permissions: none).

What it does on a page

Network and storage

Where it can and cannot run

It cannot run on browser pages (chrome://, edge://, about:), the browser's extension stores, or the built-in PDF viewer: browsers do not allow it, and the extension says so in a plain sentence. Local files need the browser's "Allow access to file URLs" switch, which is off by default.

The bookmarklets

The same fifteen tools are also offered as bookmarklets: a bookmark whose address is the tool itself. They follow the same rules: no network requests, nothing stored, nothing typed shown. A bookmarklet needs no installation and no permission, and runs only when the person clicks the bookmark. Sites with a strict Content Security Policy may refuse to run it; the extension is not affected by that.

How to check all of this

Installing it for everyone

Each browser can install an extension for every user silently, and keep it updated, from the browser's own store. All three need the extension to be listed first, because the policies below name the extension by its store ID. Until then, the placeholders <CHROME-ID>, <EDGE-ID> and <FIREFOX-ID> stay in these steps. This note is also published at swifta11y.com/for-it-teams, so nobody needs a code-hosting site to read it.

After any change, open chrome://policy, edge://policy or about:policies on a test machine. The extension and its policy should be listed with status OK, and the toolbar button should be there without anyone installing anything.

Test on one machine, then a pilot group, before the whole company. Policy names are case sensitive.

Chrome

Policies and where they go (Chrome Enterprise policy list):

PolicyTypeWhat it does
ExtensionInstallForcelistList of stringsInstalls the extension silently and keeps it. Users cannot remove or disable it. Takes precedence over ExtensionInstallBlocklist. Each entry is the ID, optionally followed by ; and an update URL. With no update URL, the Chrome Web Store is used.
ExtensionInstallAllowlistList of stringsExempts the listed IDs from ExtensionInstallBlocklist. Only needed if you block extensions in general (blocklist value *). It lets users install the extension; it does not install it.
ExtensionSettingsDictionary (JSON)One policy that can do the same and more: install mode, toolbar pinning, blocked permissions. If it sets an extension, it overrides the two policies above for that extension.

Windows, Group Policy (Active Directory): load Google's Chrome ADMX templates, then Computer Configuration, Administrative Templates, Google, Google Chrome, Extensions.

Windows, registry (same effect, for scripts or Intune custom settings), under HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Google\Chrome:

macOS, configuration profile (Jamf, Intune, Kandji and similar): a custom settings payload for the preference domain com.google.Chrome:

<key>ExtensionInstallForcelist</key>
<array>
  <string>CHROME-ID;https://clients2.google.com/service/update2/crx</string>
</array>

(Replace CHROME-ID with the real ID; the angle brackets are left out here because they would break the XML.)

The same payload can carry ExtensionInstallAllowlist (an array of IDs) or ExtensionSettings (a dictionary keyed by ID, with the fields below as strings).

Google Admin console (managed Chrome, cloud-managed):

  1. Sign in to the Admin console, then Devices, Chrome, Apps & extensions. With Chrome Browser Cloud Management it is Chrome browser, Apps & extensions.
  2. Choose Users & browsers, then the organisational unit (or a group) that should get it.
  3. Add the extension by its ID from the Chrome Web Store. (Add by ID is the yellow plus button at the bottom right. This step was not re-read from Google's page for this note; check it on screen.)
  4. Click the extension, and under Installation policy choose Force install. Click Save. (To pin it to the toolbar, use the Pin to browser toolbar choice, which writes toolbar_pin below.)
  5. To undo an override later, click Inherit.

ExtensionSettings (the modern, single policy), for Chrome:

{
  "<CHROME-ID>": {
    "installation_mode": "force_installed",
    "update_url": "https://clients2.google.com/service/update2/crx",
    "toolbar_pin": "force_pinned"
  }
}

installation_mode is allowed (default), blocked, force_installed (installed, cannot be removed), normal_installed (installed, user may disable) or removed. The two install modes need update_url, and cannot be set on the * entry. toolbar_pin is default_unpinned (default), default_pinned or force_pinned. Use normal_installed and default_pinned if people should be able to switch it off.

Microsoft Edge

Edge uses the same policy names, set under Edge's own paths (Microsoft Edge policy documentation).

PolicyEdge's caption
ExtensionInstallForcelistControl which extensions are installed silently
ExtensionInstallAllowlistAllow specific extensions to be installed
ExtensionSettingsConfigure extension management settings

ExtensionSettings for an extension listed on the Microsoft Edge Add-ons website:

{
  "<EDGE-ID>": {
    "installation_mode": "force_installed",
    "update_url": "https://edge.microsoft.com/extensionwebstorebase/v1/crx",
    "toolbar_state": "force_shown"
  }
}

Edge's installation_mode values are allowed, blocked, force_installed, normal_installed and removed. toolbar_state (Edge 103 and later) is default_hidden, default_shown or force_shown. Microsoft says a force-installed extension cannot be disabled or removed by the user, and overrides any blocklist.

Installing from the Edge Add-ons store, one person at a time: open the listing on the Microsoft Edge Add-ons website (https://microsoftedge.microsoft.com/addons/), choose Get, then Add extension. Pin it from the puzzle-piece menu next to the address bar. Edge can also add extensions from the Chrome Web Store, and Microsoft's guidance lists both stores as places to audit an extension before approving it. For a managed fleet, prefer the Edge listing and the <EDGE-ID>, so the extension updates from the store your Edge policy already allows.

Firefox

Firefox calls these enterprise policies (Mozilla's policy reference). Two policies can install an add-on: Extensions (older, with Install, Uninstall and Locked lists) and ExtensionSettings. Mozilla recommends ExtensionSettings.

policies.json (any platform). The file holds { "policies": { ... } }. Put it in a distribution folder:

{
  "policies": {
    "ExtensionSettings": {
      "<FIREFOX-ID>": {
        "installation_mode": "force_installed",
        "install_url": "https://addons.mozilla.org/firefox/downloads/latest/<ADDON-SLUG>/latest.xpi"
      }
    }
  }
}

Windows Group Policy: load Mozilla's firefox.admx and firefox.adml from the policy-templates repository. ExtensionSettings is stored as a multi-line string value ExtensionSettings under HKEY_LOCAL_MACHINE\Software\Policies\Mozilla\Firefox, holding the JSON above without the outer policies key.

macOS: a configuration profile with an ExtensionSettings key holding a dictionary, an entry per ID, and installation_mode and install_url as strings. Mozilla publishes the profile template with the policy-templates.

Linux: policies.json as above; there are no registry or profile options.

Firefox shows the policies at about:policies. The first run installs the add-on when the browser starts and can reach install_url. The add-on's strict_min_version is Firefox 140.

What was not confirmed

Sources

Reporting a concern

Report a security or privacy problem through the support page of the project's website, swifta11y.com/support, which says how to do it privately. Nothing a reviewer needs is kept only on a code-hosting site.

Changes to this note

This note is updated in the same change as anything that alters a permission or adds a script. A planned screenshot feature will add a small background script to capture the visible tab, using the activeTab permission the extension already has; this note will say so when it ships.