The `management` permission explained: what one extension can learn about all your others

You probably read the permission list before installing an extension. Good habit. Here's the twist that habit misses: one of the extensions already in your browser can quietly read the list of all the others — names, IDs, versions, what each one is allowed to do — and flip any of them off.

That's the management permission. It's not about the web pages you visit or the data on a site. It points inward, at your own extension shelf. And because it's rare and boring-sounding, most people never think about who's allowed to inventory their browser from the inside.

Let me walk through what it actually does, who legitimately needs it, and why an extension quietly holding it deserves a second look.

What the management permission actually means

When an extension declares management in its manifest, it's asking for the chrome.management API. That API was built for one audience in particular: enterprise IT admins who need to manage a fleet of browsers — see what's installed, disable risky add-ons, enforce policy.

The catch is that Chrome doesn't scope it to admins. Any extension that declares the permission gets the same reach into your personal browser. There's no "this is just for corporate" gate.

At install time, Chrome surfaces this as "Manage your apps, extensions, and themes." It's a quiet-looking string that hides a lot of capability. Unlike history or tabs, it doesn't scream "read your browsing." It reads like housekeeping. It isn't.

What the management permission actually allows

The headline call is chrome.management.getAll(). One line, and it hands back an array describing every extension and theme installed in your browser:

// With the "management" permission, this returns your entire extension shelf
chrome.management.getAll((extensions) => {
  for (const ext of extensions) {
    console.log(ext.name, ext.id, ext.version, ext.enabled, ext.permissions);
  }
});

Per the Chrome developer docs, each ExtensionInfo object carries the name, ID, version, whether it's enabled, the install type, the host permissions, and the API permissions each extension holds.

So a single call doesn't just list what you've installed — it profiles it. It can see that you run a specific password manager, a specific crypto wallet, a VPN, an ad blocker, and exactly which versions.

It goes past reading, too. chrome.management.setEnabled() lets an extension switch another one off and back on. uninstall() can remove one (with a confirmation prompt). The onInstalled, onUninstalled, onEnabled, and onDisabled events let it watch your shelf change in real time.

And this isn't a Chrome quirk. Mozilla's MDN reference documents a near-identical API for Firefox, so the same reach applies cross-browser.

Worth knowing: an extension can check its own state with chrome.management.getSelf() without any permission at all. The full-shelf getAll() is the part that needs management. That line matters when you're judging a request.

Why reading your extension list is a privacy problem

Your set of installed extensions is weirdly personal. A screen reader hints at a disability. A specific wallet hints you hold crypto. Niche productivity tools, a particular ad blocker, a translation add-on for one language — stack those together and you've got a fingerprint that's often unique to you.

I've written before about how websites pull this off from the outside — probing for extension assets, the way LinkedIn's scanning of thousands of extensions worked, as reported by BleepingComputer. The management permission is the inside-the-house version of the same idea. A website has to guess extension by extension. An extension with management just asks the browser for the whole list, cleanly, no guessing.

Then there's the sharper edge: using the list to attack. SquareX Labs demonstrated a "polymorphic" extension technique where a malicious extension abuses the chrome.management API to enumerate what you've installed, spots a high-value target like a password manager, disables the real one, and shapeshifts its own icon and popup to impersonate it — then shows a fake "session expired" login to harvest your credentials.

According to BleepingComputer's reporting, as of mid-2026 Google had not shipped a patch, because the attack uses the API exactly as intended rather than exploiting a bug. I broke down what that means for password manager extensions separately.

Who legitimately needs it

Plenty of honest tools ask for management, and for good reasons. Extension managers and "disable all my extensions with one click" utilities need it — reading and toggling the shelf is the product. Security and enterprise tools use it to audit and enforce policy. Some "tab suspender" and performance dashboards read install data to show you what's running. New-tab dashboards sometimes offer quick toggles for your other extensions.

For those, the permission is the whole point, the same way a history-search tool genuinely needs history. That's the test I keep coming back to: does this extension's obvious main job require knowing and controlling my other extensions? If yes, the request is defensible.

When it should give you second thoughts

The concern, as always, is the mismatch. A wallpaper switcher, a coupon finder, a PDF converter, a cursor theme — none of these have any reason to enumerate your extension shelf. When a small, single-purpose extension quietly declares management, the permission is doing something other than serving you: fingerprinting, competitive snooping, or setting up the kind of impersonation SquareX described.

And remember the deeper pattern — a declared permission is a statement of capability, not proof of behavior. I dug into that gap in my piece on runtime tracking versus permissions.

An extension that can read your shelf might never send it anywhere. Or it might bundle the list up and ship it to an analytics endpoint the moment it loads. The manifest alone won't tell you which — but a permission this rarely needed, sitting on an extension that clearly doesn't need it, is exactly the mismatch worth catching.

How to check your own extensions

You don't need to read any code to get a handle on this.

1. Open chrome://extensions, click Details on each one, and look for the permission line "Manage your apps, extensions, and themes." That string is management at work.
2. For every extension showing it, ask the mismatch question: does this thing's actual job need to see and control my other extensions? An extension manager — sure. A theme — no.
3. Cross-check with your footprint overall. The polymorphic attack, and most management abuse, needs a malicious extension already running in your browser. The fewer you carry, the smaller the target. I mapped how lopsided permission requests get across 308,000 listings — the risky slice is small enough to actually scrutinize.
4. If an extension fails the test, remove it. Cutting access stops the next inventory it would have taken.

Doing this one extension at a time, squinting at warning strings, is tedious and easy to get wrong. The faster path is to let a scanner cross-reference each extension's declared permissions against what it actually is — and flag the ones whose footprint doesn't match their stated purpose. That's exactly what the Extenshi catalog does, so you're not the one holding the magnifying glass.

Check your permissions →

The management permission isn't evil. For the right tool it's essential, and most extensions that request it are probably fine. But it's the one permission that turns an extension into a census-taker for everything else in your browser — and that earns it a second look, especially when the thing asking has no obvious reason to be counting.

FAQ

What is the management permission on a Chrome extension?

It's the manifest permission that unlocks the chrome.management API. With it, an extension can list every other extension and theme you have installed — names, IDs, versions, and each one's permissions — and enable, disable, or uninstall them. Chrome shows it at install time as "Manage your apps, extensions, and themes."

Is the window management permission the same thing?

No. "Window management permission" in Chrome is a site permission for arranging windows across multiple monitors — nothing to do with your extension shelf. The management extension permission is the one that can inventory your other extensions.

Which extensions actually need management?

Extension managers, one-click "disable all" utilities, and security or enterprise policy tools — anything whose core job is reading and toggling your other extensions. A wallpaper switcher or a coupon finder has no honest reason to hold it. When you spot the mismatch, that's your cue to look closer, the same way you would with an over-broad cookies permission.

Sources

• chrome.management API reference — Chrome for Developers
• management API reference — MDN Web Docs
• Malicious Chrome extensions can spoof password managers in new attack — BleepingComputer (SquareX Labs research)

This article is based on publicly available security research and news reporting. Extenshi does not independently verify all claims made by third-party researchers. References to specific companies or products reflect the findings of cited sources and do not constitute accusations of intentional wrongdoing. If you believe any information is inaccurate, please contact us at [email protected].