Chrome Extension Permissions

The principle of least privilege governs all permission decisions. Request only what the extension actively uses today — never future-proof permissions. Approximately 70% of submitted extensions over-request permissions. Over-permissioning triggers CWS rejections, alarming install warnings, and longer review cycles.

Permission Decision Rules

activeTab vs. tabs vs. host_permissions

activeTab grants temporary access to the currently focused tab only after the user explicitly invokes the extension. It requires no install warning. Always prefer it over broad alternatives.

Common Permission Misconceptions

Optional Permissions

Move non-core features to optional permissions. Request at runtime when the feature is activated:

// Request permission when user enables a feature
async function enableAdvancedFeature() {
  const granted = await chrome.permissions.request({
    permissions: ['bookmarks'],
    origins: ['https://api.example.com/*'],
  });

  if (granted) {
    // Permission granted — enable feature
  } else {
    // Permission denied — show explanation
  }
}

Benefits:

• Reduces alarming install warnings
• Gives users informed control
• Accelerates CWS review
• Permissions can be revoked when feature is disabled

Host Permission Patterns

Declare in host_permissions array (MV3), not in permissions:

{
  "host_permissions": [
    "https://api.example.com/*",
    "https://cdn.example.com/*"
  ]
}

Rules:

• Use exact domains, not wildcards
• Prefer https:// over *://
• Never use <all_urls> unless absolutely required
• Move non-essential hosts to optional_host_permissions

Pre-Release Permission Audit

Before every CWS submission:

1. Grep codebase for every chrome.* API call — verify each has a matching permission
2. Remove any declared permission not backed by a code path
3. Replace broad permissions with narrower alternatives where possible
4. Test packed .crx build to verify exact install warning dialogs
5. Prepare a short video demonstrating how each sensitive permission is used
6. Write clear cause-and-effect justifications for the CWS privacy tab

CWS Rejection Codes for Permissions

Warning: Adding permissions that trigger install warnings will temporarily disable the extension for existing users until they accept the new terms.

Additional Resources

Reference Files

• `references/permission-guide.md` — Detailed permission-by-permission reference and narrowing strategies
• `references/cws-rejection-codes.md` — Complete CWS rejection code taxonomy with prevention strategies