Add more extensions to the list.

extensions/common/api/_behavior_features.json

Index: extensions/common/api/_behavior_features.json
diff --git a/extensions/common/api/_behavior_features.json b/extensions/common/api/_behavior_features.json
index 67171f7abdded44456f54b36416253f96a48f638..af0b870961e36b64b48944ecb72551b097281d4d 100644
--- a/extensions/common/api/_behavior_features.json
+++ b/extensions/common/api/_behavior_features.json
@@ -75,12 +75,18 @@
     "channel": "stable",
     "component_extensions_auto_granted": false,
     "platforms": ["chromeos"],
-    "location": "external_component",

[Denis Kuznetsov (DE-MUC), 2016/11/30 23:22:33]

This restriction seems too strict: Virtaul Keyboard is loaded as extension, not
a component app.
Is there any chance for a side-loaded extension to have the same ID as for a
component extension?

[asargent_no_longer_on_chrome, 2016/12/01 00:22:45]

If by "side loaded" you mean loaded in development mode from
chrome://extensions, then yes, any extension id can be spoofed if you have the
corresponding public key (taken from the "key" field of the manifest"). 

If by "side loaded" you mean an extension installed via a mechanism like
drag/drop of a .crx file onto the chrome://extensions page, or via policy or
external extensions (https://developer.chrome.com/extensions/external_extensions
but probably not relevant to ChromeOS), then no, it is not possible to spoof an
id unless you have the private key to sign the .crx file with. 

     "whitelist": [
       "E24F1786D842E91E74C27929B0B3715A4689A473",  // Gnubby component extension
       "6F9E349A0561C78A0D3F41496FE521C5151C7F71",  // Gnubby app
       "8EBDF73405D0B84CEABB8C7513C9B9FA9F1DC2CE",  // Genius app (help)
-      "3F50C3A83839D9C76334BCE81CDEC06174F266AF"   // Virtual Keyboard
+      "3F50C3A83839D9C76334BCE81CDEC06174F266AF",  // Virtual Keyboard
+      "2F47B526FA71F44816618C41EC55E5EE9543FDCC",  // Braille Keyboard
+      "86672C8D7A04E24EFB244BF96FE518C4C4809F73",  // Speech synthesis
+      "1CF709D51B2B96CF79D00447300BD3BFBE401D21",  // Mobile activation
+      "D519188F86D9ACCEE0412007B227D9936EB9676B",  // Gaia auth extension
+      "40FF1103292F40C34066E023B8BE8CAE18306EAE",  // Chromeos help
+      "3C654B3B6682CA194E75AD044CEDE927675DDEE8",  // Easy unlock
+      "2FCBCE08B34CCA1728A85F1EFBD9A34DD2558B2E"   // ChromeVox

[Denis Kuznetsov (DE-MUC), 2016/11/30 23:22:33]

We can also include Chrome PDF Viewer to this list, it now attempts to load on
login screen, but I wonder if it is really needed there.

     ]
   }
   ]