1 minute read

Chrome has a fairly sophisticated set of JavaScript APIs for managing a number of different parts of the browser. These API methods are documented at

Aside from these public API methods, there are also private, undocumented, methods that are used by parts of the browser itself. One of these private API classes is chrome.bookmarkManagerPrivate, which is used on the Manage Bookmarks page.

As this API is private, it doesn’t necessarily have the same sort of protections that you’d find in public, documented methods. This can be seen with the cut method. That method, as its names suggests, cuts a bookmark and places it on the clipboard. Once a bookmark is cut, it’s immediately removed.

While you can’t cut the “Bookmarks bar” or “Other bookmarks” folders using the user interface in Chrome, you can cut both of these folders using this private API method. The browser considers both of these folders permanent and unmodifiable, so cutting (and therefore removing) the folders clearly breaks that assumption.

You can do this in the browser by going through the following steps:

  1. Navigate to chrome://bookmarks/
  2. Open the developer tools.
  3. Switch to the console tab and run the following command:
chrome.bookmarkManagerPrivate.cut(["1", "2"]);

(The “Bookmarks bar” folder has an ID of 1, while the “Other bookmarks” folder has an ID of 2).

After removing these folders, the browser will likely crash when attempting to perform other standard bookmark operations.

Ultimately, this is simply a piece of trivia about the internal implementation. The bookmarkManagerPrivate class isn’t accessible by web pages or extensions, so there’s no ability for it to be called by untrusted code. Still, it offers a simple way that you can break the assumptions made within the browser.

This behaviour should eventually be fixed - see the following issue for any updates.