Browser extension permissions are the grants an add-on must declare before a browser lets it touch anything beyond its own code: the tabs a person has open, the pages they visit, the cookies those pages set, the network requests flowing in and out. A web page can read only itself; an extension with the right grants can read and rewrite every page in the browser. The permission system exists to make that power visible and bounded before installation.

Chrome, Microsoft Edge, Firefox and Safari share the model, all building on the WebExtensions format Chrome popularised. They share its weakness too: grants are coarse, warnings are terse, and most harm done through extensions has used permissions people accepted.

How an extension declares access

Every extension ships a configuration file called manifest.json. Under Manifest V3 (MV3), the current version of that format, access is requested through four keys, according to Chrome's developer documentation:

  • permissions lists named capabilities from a fixed vocabulary, such as tabs, cookies, storage, scripting, history, downloads or declarativeNetRequest.
  • host_permissions lists match patterns naming the websites the extension may interact with. https://*.example.com/* covers one domain and its subdomains; <all_urls> or *://*/* covers every site.
  • optional_permissions and optional_host_permissions are requested later, at runtime, when a feature needs them, rather than at install.
  • content_scripts declares scripts injected into matching pages, where they can read and change the Document Object Model (DOM), the page's structured content.

Two grants deserve particular attention. activeTab gives temporary access to the current tab only after the person clicks the extension, and Chrome attaches no install warning to it. scripting combined with broad host permissions is the widest: it lets code be injected into any matching page at any time.

What the install prompt shows

Chrome turns requested grants into plain-language warnings. According to Chrome's permissions reference, tabs produces "Read your browsing history", clipboardRead produces "Read data you copy and paste", and proxy produces "Read and change all your data on all websites", the same line that all-sites host access triggers.

Several powerful grants carry no warning of their own. The reference lists none for cookies, scripting, webRequest, storage or activeTab. Warnings also merge: Chrome's guidelines note that the tabs warning disappears when <all_urls> is requested.

Updates are the other checkpoint. If a new version adds a permission that triggers a warning, Chrome disables the extension until the person accepts. Updates that change only code install silently, so permissions describe what an extension could do, not what its current code does.

Site access: the "all sites" problem

Host permissions concentrate the risk. All-sites access lets an extension read login forms, copy webmail, rewrite checkout links and act inside signed-in pages.

Chrome 70 let people narrow that grant after install. James Wagner, then Chrome extensions product manager, wrote on October 1, 2018 that "users will have the choice to restrict extension host access to a custom list of sites". The menu offers "On click", "On specific sites" or "On all sites", but the default after installation remains all requested sites.

Other browsers chose stricter defaults. Firefox prompts for MV3 host permissions at install from Firefox 127 in June 2024, and "MV3 host permissions can still be revoked by the user at any time", according to Mozilla's add-ons blog of May 14, 2024. Safari, which added web extensions in 2020, asks per website, with access granted "for one day or always", according to Apple's WWDC 2020 session on the format.

From Manifest V2 to V3

Google signalled a new manifest in the same October 2018 post. MV3 reached Chrome 88 Beta on December 9, 2020. According to Chrome's David Li and Simeon Vincent, it disallowed remotely hosted code, replaced persistent background pages with service workers and introduced declarativeNetRequest, which lets ad blockers "block network requests without accessing sensitive data".

The contested change concerns webRequest. Under Manifest V2 (MV2), an extension could intercept each request in its own code and decide whether to block it. MV3 removed that blocking ability for most extensions; instead, the extension hands Chrome a rule list and the browser applies it. Chrome's documentation guarantees 30,000 static rules per extension, with a shared pool of 300,000 allowing up to 330,000, plus 30,000 dynamic rules, of which only 5,000 may be "unsafe" types such as redirects.

The Chrome Web Store stopped accepting new public MV2 extensions in January 2022. Stable Chrome began disabling MV2 add-ons on October 9, 2024, disabled them by default from March 31, 2025, and removed the option to re-enable them in Chrome 138 on July 24, 2025. Remaining MV2 listings were removed from the store on August 31, 2026, according to Chrome's deprecation timeline. Edge began its consumer phase-out in August 2026, with managed enterprise devices following in early 2027. Mozilla says webRequest "is not on a deprecation path in Firefox", and MV2 remains supported there.

Store review and policy

The Chrome Web Store's program policies require developers to "request access to the narrowest permissions necessary", give each extension "a single purpose that is narrow and easy to understand", and restrict user data to what that purpose needs, with sale for personalised advertising "completely prohibited". Under MV3, remote logic may run only through documented interfaces such as the User Scripts API.

The store banned obfuscated code in October 2018. On March 11, 2025, it tightened affiliate rules: an extension may insert an affiliate link, code or cookie only after a related user action and only when it gives the person a direct benefit, with enforcement from June 10, 2025.

Why it matters to marketers

Extensions sit between advertisers, publishers and audiences. Google and researchers at the University of California, Berkeley found in March 2015 that about 5% of visitors to Google sites had at least one ad injector installed, according to TechCrunch, and Google removed 192 Chrome extensions affecting 14 million users. Injection needs only content scripts with broad host access.

Affiliate hijacking works the same way. The case against PayPal's Honey alleges that the coupon extension replaced creators' affiliate tracking while detecting compliance testers to stay hidden, using standdown rules fetched hourly from a server rather than shipped in reviewed code. Judge Beth Labson Freeman denied PayPal's renewed motion to dismiss on June 22, 2026; the claims remain allegations.

Ad accounts are a target in their own right. In December 2024, attackers phished a Cyberhaven employee with a fake Chrome Web Store notice, then pushed an update harvesting access tokens mainly from Facebook Ads users, according to The Hacker News. No new permission meant no warning. Stolen tokens enable session hijacking.

Data sales are often lawful on paper. LayerX found 82 extensions with at least 6.5 million users whose privacy policies reserve the right to sell browsing data, eight of them ad blockers. It also put 75% of enterprise extensions at high or critical permission levels.

AI sidebars widen the exposure. LayerX telemetry shows AI extensions request cookie access almost three times as often as the average extension and scripting access 41.91% of the time, against 15.4%. On January 6, 2026, OX Security reported two AI sidebars with about 900,000 users sending chatbot conversations and tab URLs to a server every 30 minutes, according to The Hacker News. Agentic extensions acting in signed-in tabs inherit prompt injection risk: Anthropic measured a 23.6% attack success rate for Claude for Chrome without mitigations, falling to 11.2% with them. Corporate control of such tools overlaps with shadow AI and data loss prevention.

Criticisms and disputes

The sharpest dispute is over ad blocking. Chrome's MV3 transition forced uBlock Origin, with more than 31 million users, out of the store; its replacement, uBO Lite, lacks dynamic filtering and per-site switches. The Electronic Frontier Foundation's Daly Barnett wrote on December 9, 2021 that MV3 "is outright harmful to privacy efforts", arguing that malicious extensions mostly read data through non-blocking webRequest, which MV3 kept, and pointing to Google's conflict as browser vendor and ad network. Google's 2020 announcement argued the reverse: declarative blocking spares filters from seeing request data at all.

Permission fatigue is the second critique. Warnings appear once, describe capability broadly and cannot separate an honest coupon tool from a dishonest one with identical grants, while ownership changes or compromised developer accounts alter behaviour without a prompt. The permission model is also visible to sites: LinkedIn is accused of probing for more than 6,000 extensions through files exposed by web_accessible_resources.

Not to be confused with

  • Website permissions are prompts a site triggers for camera, microphone, location or notifications, granted per origin rather than to an add-on.
  • OAuth scopes define what a third-party application may do inside an online account, such as Google Ads, through an API. OAuth consent is separate, though the Cyberhaven case shows it can be abused to seize a developer's store account.
  • Mobile app permissions on Android and iOS govern device resources such as contacts, managed by the operating system.
  • Content Security Policy is a header a website sends to limit which scripts its own pages may load. It constrains sites, and browsers generally let extension content scripts operate outside it.

Recent developments

As of October 2026 the defaults are shifting. Chrome Canary is testing an install prompt that asks whether a new extension should run "When you click the extension" or "Always on all sites", plus an "Ask on every visit" option, according to PiunikaWeb on October 6, 2026; Google has given no release date. OpenAI's ChatGPT extension gained control of Chrome tabs on October 15, 2026, reading open tabs and filling forms in signed-in sessions. Edge's MV2 phase-out continues through the end of 2026, leaving Firefox as the main desktop browser still offering blocking webRequest.

Timeline

  • December 2009 - Chrome opens extensions to the public with an extensions gallery.
  • March 31, 2015 - Google and UC Berkeley report about 5% of visitors to Google sites run ad injectors; 192 extensions affecting 14 million users banned.
  • November 2017 - Firefox 57 moves exclusively to the WebExtensions format.
  • October 1, 2018 - Google announces per-site host access controls for Chrome 70, an obfuscated code ban and a future manifest version.
  • September 2020 - Safari 14 adds web extensions with per-site, one-day-or-always grants.
  • December 9, 2020 - Manifest V3 arrives in Chrome 88 Beta with declarativeNetRequest and a remote code ban.
  • December 9, 2021 - The EFF calls MV3 "deceitful and threatening".
  • January 2022 - Chrome Web Store stops accepting new public MV2 extensions.
  • January 2023 - Firefox 109 enables MV3 by default.
  • June 11, 2024 - Firefox 127 prompts for MV3 host permissions at install.
  • October 9, 2024 - Chrome stable starts disabling MV2 extensions.
  • December 24-27, 2024 - Cyberhaven extension compromised and disclosed.
  • December 29, 2024 - Class action filed against PayPal over Honey.
  • March 11, 2025 - Chrome Web Store tightens affiliate rules, enforced from June 10, 2025.
  • July 24, 2025 - Chrome 138 removes the ability to re-enable MV2 extensions.
  • January 6, 2026 - OX Security reports AI sidebar extensions exfiltrating chats from about 900,000 users.
  • April 26, 2026 - LayerX publishes its extension security report on data sales and permissions.
  • June 22, 2026 - Court denies PayPal's renewed motion to dismiss in the Honey case.
  • August 2026 - Edge begins its consumer MV2 phase-out.
  • August 31, 2026 - Chrome Web Store removes remaining MV2 extensions.
  • October 3-6, 2026 - Chrome Canary testing of click-to-run defaults for new extensions reported.
  • October 15, 2026 - OpenAI's ChatGPT Chrome extension gains tab control.

Summary

Who: Browser vendors (Google for Chrome, Microsoft for Edge, Mozilla for Firefox, Apple for Safari) define and enforce extension permissions; developers request them; stores such as the Chrome Web Store review them; people and enterprise IT teams grant or restrict them. Ad blockers, coupon tools, AI assistants and attackers are among the heaviest users of broad grants.

What: A set of manifest-declared grants, including named API permissions, host permissions using match patterns, optional runtime permissions and content scripts, that determine which data and sites an extension can reach, surfaced to people as install and update warnings.

When: Extension permissions date to Chrome's public extensions launch in 2009. Per-site controls arrived in Chrome 70 in October 2018, Manifest V3 in December 2020, and Chrome's MV2 shutdown ran from October 2024 to the removal of remaining MV2 listings on August 31, 2026.

Where: In every desktop browser built on the WebExtensions format, inside the browser itself, which places extensions between people and every website they open, including ad platforms, retailer checkouts and signed-in accounts.

Why: Extensions hold more power than web pages, so permissions exist to make that power visible and limited. For the marketing community they matter because the same grants enable ad blocking, ad injection, affiliate hijacking, theft of ad account sessions and AI tools that read whatever a page displays.