Permissions are declared in an extension's manifest.json and softened into friendly language in the install warning. This dictionary gives you the real version: what each one grants, and how we rate it. The scale is the one Ostral's scanner uses, Critical, High, Medium, or Low. Each permission is graded on what it enables if the extension turns, not on the average case, and it is only truly justified if the extension's job needs it.
Host permissions
Read these first. Host permissions decide which sites the extension can reach, which is the blast radius for everything else. Any broad host access is Critical on its own.
Permission | What it grants | Risk |
|---|---|---|
| Reads and modifies data on every website the user visits, the widest reach there is | Critical |
| Reads and modifies data on every website the user visits | Critical |
| Every http site and every https site (http being the plaintext half) | Critical |
| One named domain and its subdomains, the scoped and expected case | Low |
| Temporary access to the current tab, only when the user clicks the extension | Medium |
Critical permissions
These hand an extension deep control: your traffic, your screen, your files, your credentials. Treat any of them as a stop-and-review, whatever the tool claims to be.
Permission | What it grants | Risk |
|---|---|---|
| Full control over browser protocols, for deep monitoring and modification of activity | Critical |
| Routes traffic through a third-party server, potentially exposing all browsing | Critical |
| Intercepts and modifies data between the browser and websites before it loads | Critical |
| Blocks resources from loading or alters content delivered by websites | Critical |
| Saves complete copies of visited pages, text and images, to a file | Critical |
| Records the entire screen, specific apps, or browser tabs | Critical |
| Talks directly to apps on the operating system, bypassing the browser sandbox | Critical |
| Runs custom scripts on webpages, altering their content or behavior | Critical |
| Reads and writes files on the local drive | Critical |
| Intercepts and modifies authentication requests, potentially compromising credentials | Critical |
High-risk permissions
Each of these exposes sensitive data or lets the extension act as the user. High on its own, and often part of a takeover once paired with broad host access.
Permission | What it grants | Risk |
|---|---|---|
| Reads and modifies cookies, which hold sessions and login state | High |
| Accesses OAuth2 tokens to act on behalf of the user | High |
| Accesses the email address of the signed-in browser account | High |
| Reads, modifies, and deletes the record of visited sites | High |
| Reads the titles and URLs of every open tab | High |
| Monitors navigation between pages in real time | High |
| Starts downloads from the internet to local storage | High |
| Reads whatever is on the clipboard | High |
| Replaces what is on the clipboard | High |
| Manages, disables, or uninstalls other extensions | High |
| Changes browser privacy and security settings | High |
| Changes per-site access to cookies, JavaScript, and plugins | High |
| Detects the user's precise location | High |
| Captures the audio and video of the current tab | High |
| Captures audio from the microphone | High |
| Captures video from the camera | High |
| Blocks or rewrites network requests by rule | High |
| Modifies data sent to or from permitted sites | High |
| Clears history, cookies, and cached files | High |
| Handles HTTP auth prompts, potentially seeing entered credentials | High |
| Reads, creates, and deletes bookmarks | High |
| Implements a VPN client, with full visibility and control of traffic | High |
| Expose client certificates for authentication | High |
Medium-risk permissions
Meaningful reach, worth a second look when the stated purpose does not obviously call for it.
Permission | What it grants | Risk |
|---|---|---|
| Temporary access to the current tab, only on user click | Medium |
| Injects and runs code on pages to change content or behavior | Medium |
| Stores extension data locally, with or without a size limit | Medium |
| Reads open sessions and tabs, possibly from other devices | Medium |
| Reads the list of most-visited sites | Medium |
| Organizes and modifies tab groups | Medium |
| Runs in the background even with no tabs open | Medium |
| Runs tasks in hidden documents the user never sees | Medium |
| Shows pop-up alerts | Medium |
| Adds items to the right-click menu | Medium |
| Resolves hostnames, which can reveal browsing habits | Medium |
| Implements a text-to-speech engine, seeing the text sent to it | Medium |
| Sends and receives push messages via Google Cloud Messaging | Medium |
| Detects external drives, or exposes a file system to the file manager | Medium |
Low-risk utilities
Common and low-signal on their own. They add context to the powerful permissions above rather than posing a standalone risk.
Permission | What it grants | Risk |
|---|---|---|
| Timers, idle detection, keyboard shortcuts, keep-awake | Low |
| Display, fonts, search, side panel, windows, speech, reading list | Low |
| Printing and document scanning | Low |
| Basic device hardware and display metadata | Low |
| Other low-signal utilities | Low |
The combinations that bite
No single permission is malicious by itself. The danger is a combination that exceeds the stated function. A few to recognize on sight:
<all_urls>pluscookies: session hijacking across every site.proxyin anything that is not explicitly a VPN or proxy tool: a way to reroute all traffic.tabCaptureorpageCapturein a tool that is not a recorder: silent capture of meetings, screens, and page content.scriptingordebuggerplus broad host access: arbitrary code on every page the user opens.nativeMessagingplus broad host access: a bridge from a web page to the operating system.
Work top to bottom. Check the host permissions for blast radius, then scan for anything in the Critical or High tables. Then ask the one question that matters: does the stated function need this? For the full method, see Part 3 of the series.
