A browser extension permission is a capability the extension asks the browser for: reading the pages you visit, seeing your tabs, touching your cookies, rerouting your traffic. Every permission is declared in the extension's manifest.json, and the browser turns the riskiest ones into a short install warning, such as "Read and change all your data on all websites". Most people click through it. This dictionary gives you the real version: what each permission grants, and how we rate it.
The scale is the one Ostral's scanner uses, Critical, High, Medium, or Low. Each permission is graded on what it enables if the extension turns, not on the average case, and it is only truly justified if the extension's job needs it. Updated in October 2026 with the permissions specific to Firefox and the questions we hear most.
The three kinds of permissions
An extension can reach your data in three ways, and a review has to read all three:
Kind | Where it is declared | What it decides |
|---|---|---|
API permissions |
| Which browser capabilities the extension can use: tabs, cookies, proxy, downloads, screen capture |
Host permissions |
| Which websites the extension can read and change. A content script that runs on every site reaches as far as a host permission does |
Optional permissions |
| Capabilities the extension can request later, while it runs, long after the install warning was read |
Chrome and Edge share the same permission names, since both run on Chromium. Firefox uses most of them too, plus a few of its own, listed further down.
Host permissions
Read these first. Host permissions decide which sites the extension can reach, which is the blast radius for everything else. Any broad host access is Critical on its own.
Permission | What it grants | Risk |
|---|---|---|
| Reads and modifies data on every website the user visits, the widest reach there is | Critical |
| Reads and modifies data on every website the user visits | Critical |
| Every http site and every https site (http being the plaintext half) | Critical |
| One named domain and its subdomains, the scoped and expected case | Low |
| Temporary access to the current tab, only when the user clicks the extension | Medium |
Critical permissions
These hand an extension deep control: your traffic, your screen, your files, your credentials. Treat any of them as a stop-and-review, whatever the tool claims to be.
Permission | What it grants | Risk |
|---|---|---|
| Full control over browser protocols, for deep monitoring and modification of activity | Critical |
| Routes traffic through a third-party server, potentially exposing all browsing | Critical |
| Intercepts and modifies data between the browser and websites before it loads | Critical |
| Blocks resources from loading or alters content delivered by websites | Critical |
| Saves complete copies of visited pages, text and images, to a file | Critical |
| Records the entire screen, specific apps, or browser tabs | Critical |
| Talks directly to apps on the operating system, bypassing the browser sandbox | Critical |
| Runs custom scripts on webpages, altering their content or behavior | Critical |
| Reads and writes files on the local drive | Critical |
| Intercepts and modifies authentication requests, potentially compromising credentials | Critical |
High-risk permissions
Each of these exposes sensitive data or lets the extension act as the user. High on its own, and often part of a takeover once paired with broad host access.
Permission | What it grants | Risk |
|---|---|---|
| Reads and modifies cookies, which hold sessions and login state | High |
| Accesses OAuth2 tokens to act on behalf of the user | High |
| Accesses the email address of the signed-in browser account | High |
| Reads, modifies, and deletes the record of visited sites | High |
| Reads the titles and URLs of every open tab | High |
| Monitors navigation between pages in real time | High |
| Starts downloads from the internet to local storage | High |
| Reads whatever is on the clipboard | High |
| Replaces what is on the clipboard | High |
| Manages, disables, or uninstalls other extensions | High |
| Changes browser privacy and security settings | High |
| Changes per-site access to cookies, JavaScript, and plugins | High |
| Detects the user's precise location | High |
| Captures the audio and video of the current tab | High |
| Captures audio from the microphone | High |
| Captures video from the camera | High |
| Blocks or rewrites network requests by rule | High |
| Modifies data sent to or from permitted sites | High |
| Clears history, cookies, and cached files | High |
| Handles HTTP auth prompts, potentially seeing entered credentials | High |
| Reads, creates, and deletes bookmarks | High |
| Implements a VPN client, with full visibility and control of traffic | High |
| Expose client certificates for authentication | High |
Medium-risk permissions
Meaningful reach, worth a second look when the stated purpose does not obviously call for it.
Permission | What it grants | Risk |
|---|---|---|
| Temporary access to the current tab, only on user click | Medium |
| Injects and runs code on pages to change content or behavior | Medium |
| Stores extension data locally, with or without a size limit | Medium |
| Reads open sessions and tabs, possibly from other devices | Medium |
| Reads the list of most-visited sites | Medium |
| Organizes and modifies tab groups | Medium |
| Runs in the background even with no tabs open | Medium |
| Runs tasks in hidden documents the user never sees | Medium |
| Shows pop-up alerts | Medium |
| Adds items to the right-click menu | Medium |
| Resolves hostnames, which can reveal browsing habits | Medium |
| Implements a text-to-speech engine, seeing the text sent to it | Medium |
| Sends and receives push messages via Google Cloud Messaging | Medium |
| Detects external drives, or exposes a file system to the file manager | Medium |
Low-risk utilities
Common and low-signal on their own. They add context to the powerful permissions above rather than posing a standalone risk.
Permission | What it grants | Risk |
|---|---|---|
| Timers, idle detection, keyboard shortcuts, keep-awake | Low |
| Display, fonts, search, side panel, windows, speech, reading list | Low |
| Printing and document scanning | Low |
| Basic device hardware and display metadata | Low |
| Other low-signal utilities | Low |
Permissions specific to Firefox
Firefox add-ons can request a few permissions that Chrome and Edge do not have. Two of them sit at the top of the scale.
Permission | What it grants | Risk |
|---|---|---|
| Reads and rewrites the content of web responses before the page receives them | Critical |
| Installs security modules that hold certificates and keys, which can change what the browser trusts | Critical |
| Changes global browser settings, such as the home page, the new tab page and link behavior | High |
| Creates and manages container tabs, which keep browsing data apart | Medium |
| Adds options to the browser's menus, including the right-click menu (the Firefox name for | Medium |
| Hides and shows browser tabs | Medium |
| Searches the text of open pages and highlights the matches | Medium |
| Detects public Wi-Fi login pages, changes the browser's look, replaces the right-click menu on its own pages | Low |
The combinations that bite
No single permission is malicious by itself. The danger is a combination that exceeds the stated function. A few to recognize on sight:
<all_urls>pluscookies: session hijacking across every site.proxyin anything that is not explicitly a VPN or proxy tool: a way to reroute all traffic.tabCaptureorpageCapturein a tool that is not a recorder: silent capture of meetings, screens, and page content.scriptingordebuggerplus broad host access: arbitrary code on every page the user opens.nativeMessagingplus broad host access: a bridge from a web page to the operating system.
Work top to bottom. Check the host permissions for blast radius, then scan for anything in the Critical or High tables. Then ask the one question that matters: does the stated function need this? For the full method, see Part 3 of the series.
Frequently asked questions
What does "Read and change all your data on all websites" mean?
It is the warning for broad host access, such as <all_urls> or *://*/*. The extension can read every page the user opens, including what they type, and change it: rewrite links, inject scripts, send page content elsewhere. A useful tool and a data-theft payload ask for it in the same words, which is why it rates Critical on its own.
Are optional permissions safer than required ones?
They are less visible, not safer. An optional permission is requested while the extension runs, so it never appears in the install warning that people read once. Review them with the same tables as the required ones.
Can an extension gain permissions in an update?
Yes. When an update asks for permissions that trigger a new warning, Chrome disables the extension until the user accepts them, and many users accept. An extension can also keep the same permissions and change what it does with them, through new code or a configuration it fetches from its server. That is why a permission review is only true for the version you checked.
Which permissions are the most dangerous together?
Broad host access combined with cookies, scripting, debugger or nativeMessaging, and proxy in anything that is not a VPN. The list above explains each pairing.
Do Edge and Firefox use the same permissions as Chrome?
Edge uses exactly the same names, since it runs on Chromium. Firefox shares most of them and adds its own, listed in the Firefox table above.
