Deep Dive · 6 min read
Chrome Extension Permissions Explained (and How to Ask for Fewer)
Every Chrome extension declares permissions. Asking for too many gets you rejected — and scares users. Here's how to ask for less.
Permissions are the single biggest reason Chrome extensions get rejected or uninstalled. The good news: most extensions ask for far more than they actually need.
The permission types
- API permissions — `storage`, `alarms`, `tabs`, `scripting`. Required to call those Chrome APIs.
- Host permissions — `https://example.com/*` or `<all_urls>`. Required to read/modify a site's pages.
- Optional permissions — requested at runtime, not install time. Far less scary for users.
How to ask for less
- Use `activeTab` instead of `<all_urls>` when you only need the current tab on user action.
- Use `host_permissions` scoped to specific domains, not the universal wildcard.
- Move non-essential permissions to `optional_permissions` and request them on demand.
- Use the `scripting` API instead of declaring content scripts for every page.
ManifestGo defaults to the narrowest permissions that satisfy your prompt. If you describe a YouTube tweak, you get host access to youtube.com — not the entire web.