chrome-ext-permissionslisted

# Chrome Extension Permissions The principle of least privilege governs all permission decisions. Request only what the extension actively uses today — never future-proof permissions. Approximately 70% of submitted extensions over-request permissions. Over-permissioning triggers CWS rejections, alarming install warnings, and longer review cycles. ## Permission Decision Rules ### activeTab vs. tabs vs. host_permissions | Need | Use | Why | |------|-----|-----| | Temporary access after user click | `activeTab` | No install warning, minimal scope | | Read URL/title of tabs without host access | `tabs` | Required for `tab.url`, `tab.title`, `tab.favIconUrl` | | Persistent access to specific sites | `host_permissions: ["https://example.com/*"]` | Narrow host pattern | | Access to all sites | `host_permissions: ["<all_urls>"]` | **Last resort** — triggers 3x rejection rate | `activeTab` grants temporary access to the currently focused tab only after the user explicitly invokes the extension. It requires no install warning. Always prefer it over broad alternatives. ### Common Permission Misconceptions | Misconception | Reality | |---------------|---------| | "Need `tabs` to use `chrome.tabs` API" | Most `chrome.tabs` methods work without the permission | | "Need `storage` for localStorage" | `storage` is only for `chrome.storage` API, not web storage | | "Need `cookies` for `document.cookie`" | `cookies` permission is only for `chrome.cookies` API | | "Need `<all_urls>` to wo