MacOS Firewall: 'Do you want the application "Google Chrome.app" to accept incoming network connections?'

Question

Earlier today, I decided to review my MacOS Catalina Firewall settings by deleting my previous application-specific settings, and handle future prompts one at a time.

Then when visiting chrome://flags#hardware-media-key-handling in Google Chrome flag settings, changing the setting, and relaunching Chrome, I received the below MacOS Firewall prompts:

Do you want the application "Google Chrome.app" to accept incoming network connections?

Do you want the application "Google Chrome Helper.app" to accept incoming network connections?

I am wondering why Chrome asks for these permissions.

I have quite a lot of Chrome Extensions installed, so I'm concerned about security and don't want to accept incoming connections unless they are core to Chrome's functionality. Is accepting incoming connections necessary for basic functionality like Chrome Update checks? Of course, I'm also considering that these prompts appeared because I visited the Chrome flags settings page – maybe that automatically happens because of some functionality therein?

I am using these general MacOS Firewall settings:

Answer 1

Yours does not seem to be an isolated issue. This thread on MacRumors is asking almost the same question: Keep being asked if I want to allow incoming connections on google chrome helper app with a possible solution at post #9. Here's the gist of it:

I had the same issue with Chromium, and a member of a site that provides updated Chromium builds posted this fix:

xattr -csr /Applications/Chromium.app. <---- this terminal code worked on my iMac

It also points to an issue on ungoogled-chromium-macOS GitHub repository titled Incoming network connections firewall permission prompts on every launch #17 with two other suggested workarounds:

sudo codesign --force --deep --sign - /Applications/Chromium.app

You'd be replacing the code signature with this one so be careful!

The second one is less involved:

Looks like we can use below two commands instead of sudo.

clears extended file attributes of app bundle and its internal files xattr -cr out/Default/Chromium.app

apply ad-hoc signing to all files and folders in app bundle. codesign --force --deep --sign - out/Default/Chromium.app

No guarantee, however, as I haven't had this issue personally and can't test the solutions.