Extension permissions by the numbers: what 308,000 browser extensions actually request

Most permission advice for browser extensions is anecdotal. Someone finds one creepy extension, writes it up, and the takeaway is "be careful out there." Useful, but it never tells you what normal looks like — so you can't tell whether the thing you just installed is unusual or completely ordinary.

So I did the boring thing instead. I pulled the declared manifest permissions for every live listing in the Extenshi catalog — 308,210 extensions across Chrome, Firefox, and Edge — and counted. The result is a map of what extensions actually ask for, at scale.

Some of it is reassuring. A couple of numbers made me sit up.

All figures below come from the Extenshi catalog snapshot taken 2026-06-01. These are declared permissions straight from the manifest, not scanner verdicts — an extension asking for something isn't proof it does anything bad with it.

The shape of the ecosystem

Here's the top of the list, by share of all 308,210 live listings:

• storage — 191,369 extensions (62.1%)
• activeTab — 108,948 (35.3%)
• tabs — 88,248 (28.6%)
• scripting — 66,801 (21.7%)
• contextMenus — 34,977 (11.3%)
• <all_urls> — 22,888 (7.4%)
• cookies — 15,680 (5.1%)
• clipboardWrite — 12,823 (4.2%)
• nativeMessaging — 3,515 (1.1%)

The headline: storage is on nearly two out of three extensions. That sounds scary until you remember storage just lets an extension save settings and state on your own machine. A dark-mode toggle needs it. A to-do extension needs it.

It's the most boring permission on the list, and its ubiquity is the single most reassuring number here — most of the catalog is mundane utilities saving their own preferences.

activeTab (35.3%) is the next chunk, and it's the good pattern. It grants access to the current tab only when you click the extension, then expires. It's the permission a well-behaved extension reaches for instead of demanding everything.

The numbers worth pausing on

Now the ones that matter. <all_urls> shows up on 22,888 extensions — 7.4% of the catalog. That single token grants read and write access to every website you visit: your bank, your email, your work tools, your health portal.

I broke down exactly what that warning covers in my earlier piece on host permissions, but the population view adds something the explainer can't. Roughly one in every 13 extensions in the wild holds the broadest access the platform allows.

Plenty of those 22,888 have a legitimate reason — ad blockers, password managers, and translation tools genuinely need broad reach to do their job. The problem isn't that <all_urls> exists. It's that the warning dialog looks identical whether the extension is a reputable ad blocker or a screenshot tool that has no business reading your bank's DOM.

Then cookies at 5.1% — 15,680 extensions. Cookies carry session tokens and login state, so an extension with this permission can read the credentials that keep you logged in. I went deep on the mechanics in my cookies permission write-up; the short version is that "5% of everything" is a lot of extensions sitting next to your active sessions.

The long tail is where it gets interesting

nativeMessaging is only on 1.1% of extensions — 3,515 of them — and that low number is exactly why it's worth a look. This permission lets an extension talk to a program running on your actual operating system, outside the browser sandbox. It's the bridge from "a thing in your browser" to "a thing on your computer."

Rare, powerful, and the kind of capability you want a very good reason for. I covered why in my native messaging breakdown.

clipboardWrite (4.2%) can quietly replace what you copy — relevant if you've ever pasted a crypto wallet address. webRequest (5.3%) can inspect network traffic. None of these are alarming on their own. The signal is in the combination: a simple-looking extension that asks for <all_urls> plus cookies plus nativeMessaging is reaching far past what its description suggests.

Risk assessment: when a permission is fine vs. worth a second look

Here's the rule of thumb I use after staring at this data:

Usually fine on its own: storage, activeTab, contextMenus, alarms, notifications. These are the plumbing of normal extensions. Their presence tells you almost nothing.

Match it to the description: <all_urls>, scripting, tabs, webRequest. An ad blocker or password manager asking for these makes sense. A wallpaper changer asking for them does not. The question is never "is this permission dangerous" — it's "does this extension's job explain why it needs this."

Worth a real pause: cookies, nativeMessaging, clipboardRead, proxy (only 0.8%, but it can route all your traffic). Ask out loud what the extension would do with it. If you can't answer, that's your answer.

The catalog-wide takeaway: the median extension is genuinely boring. The privacy risk isn't spread evenly across 308,000 extensions — it's concentrated in the slice holding broad access tokens, and that slice is small enough to actually scrutinize.

How to check your own extensions

You don't need a database query to do this. For any extension you've got installed:

1. Open your browser's extensions page (chrome://extensions, about:addons, or edge://extensions) and click "Details" on each one.
2. Find the permissions section. Look specifically for "read and change all your data on all websites" — that's <all_urls> in plain English.
3. Ask the description-match question: does what this extension does justify what it asks for?
4. For anything holding broad access you can't justify, remove it. An unused extension with <all_urls> is pure downside.

If you'd rather not click through every one by hand, that's the whole reason Extenshi exists. Paste an extension or scan what you've got installed and it'll surface exactly these permissions, flagged by how much access they really grant.

Check your permissions →

The map is clear: most of the ecosystem is harmless utilities saving their settings. But a real, countable minority holds the keys to your entire browsing life — and now you know roughly how many, and which permissions to look for first.

Methodology

The counts come from a single snapshot of the Extenshi catalog taken 2026-06-01: 308,210 live listings across the Chrome Web Store, Firefox Add-ons, and Edge Add-ons. For each listing I read the permissions and host_permissions arrays straight from the parsed manifest.json and tallied the share of listings declaring each token. Percentages are over all 308,210 live listings, not per store.

Two caveats worth repeating. These are declared permissions, not observed behavior — an extension requesting <all_urls> isn't proof it abuses it, and one declaring nothing unusual can still be doing something with the access it has (a gap I dug into in runtime tracking vs. permissions). And "live" means present in the stores at snapshot time; delisted or removed extensions aren't counted.

---

This article is based on first-party aggregate data from the Extenshi catalog (snapshot 2026-06-01) and reflects declared manifest permissions, not scanner verdicts. Extenshi does not independently verify the intent behind any individual extension's declared permissions. If you believe any information is inaccurate, please contact us at [email protected].