Why Extension Permissions Deserve a Second Look
Browser extensions run with far more access than most people realize. A permission like "<all_urls>" doesn't just mean the extension works on websites — it means the extension can read, and often modify, literally everything you see and type on every site you visit, including banking portals and webmail. Unlike mobile apps, most browsers don't show a friendly permission prompt broken down in plain language; they show a technical string from the manifest file, and most users click “Add extension” without a second thought.
Extension-based supply chain attacks are one of the most common ways attackers gain broad access to victims' browsing sessions in 2026 — a previously trustworthy extension gets sold to a new owner, or a malicious update ships quietly, and a tool millions of people already trust starts harvesting cookies or injecting ads.
How Manifest Permissions Work
Every browser extension declares two kinds of access in its manifest.json: API permissions (like tabs, cookies, or webRequest) which unlock specific browser capabilities, and host permissions (like <all_urls> or a specific domain pattern) which control which websites those capabilities apply to. A permission is only as risky as the host access paired with it — cookies access scoped to one domain is very different from cookies access paired with <all_urls>.
Permissions Worth Pausing On
- <all_urls> / *://*/*: full read/write access to every website — the broadest permission an extension can request.
- webRequest / webRequestBlocking: can observe or even intercept and modify every network request your browser makes.
- nativeMessaging: lets the extension talk to a program installed outside the browser sandbox entirely.
- clipboardRead: can read whatever you last copied — including passwords and 2FA codes.
- management: can see and control your other installed extensions.
- proxy: can reroute all of your network traffic through a server of the extension's choosing.
None of these are automatically malicious — plenty of legitimate password managers, ad blockers, and productivity tools need broad access to function. The point isn't to avoid every high-permission extension; it's to make sure the permission list matches what the tool is supposed to do.
Step-by-Step: Auditing an Extension Before You Install It
- Find the manifest. On the Chrome Web Store or Firefox Add-ons page, permissions are listed under “This extension can:”, or download the .crx/.xpi and inspect
manifest.jsondirectly. - Ask whether it matches the extension's job. A calculator app requesting
webRequestand<all_urls>is a red flag; a password manager requesting the same is expected. - Check host permission scope. Extensions limited to specific domains are inherently safer than ones with blanket access.
- Look for high-risk permissions stacked together — cookies plus <all_urls> plus webRequest is enough to silently exfiltrate session tokens from any site.
- Re-audit after major updates. Extensions can add new permissions in later versions — periodically re-checking what's installed catches scope creep.
- Remove what you don't use. Every installed extension is attack surface, even a dormant one.
Reading a permission list line by line and translating it into what it could actually do takes a few minutes with the right dictionary of terms — but it's a few minutes that can be the difference between installing a helpful tool and handing over your entire browsing session.
What a Good Permission Audit Actually Produces
The most useful output isn't a single pass/fail verdict — permissions aren't binary, and a blanket "this extension is dangerous" verdict is rarely accurate or actionable. A useful audit instead breaks a manifest down permission by permission, assigns each one a severity independently, and then rolls those up into an overall picture so you can see both the forest and the trees: which specific permission is the biggest concern, and how the whole bundle compares to a typical extension in the same category.
This matters especially for extensions bundled with dozens of permissions at once, where it's easy for one genuinely alarming entry — nativeMessaging or proxy, for instance — to get lost in a long list of low-risk ones like storage or alarms. Sorting by severity and reading the highest-risk items first turns a wall of technical strings into a two-minute decision.