28 articles found
A hands-on Manifest V3 tutorial: use the chrome.management API and Chrome's own permission warnings to audit every extension installed. Full runnable code.
Replacing your new tab page takes no permission at all. Here's what a new tab override extension can really see, when it's fine, and how to check yours.
Chrome extension optional permissions, end to end: install with no warning, then request topSites and a single host at runtime. Full MV3 code, ~25 minutes.
Mozilla's W3C proposal puts AI agent permissions on the browser's extension model. I counted that model at scale: 300,503 extensions, 12,277 already pulled.
The downloads permission lets an extension read every file you've downloaded, write new ones, and hide the download UI. Here's what it allows and how to check.
The debugger permission gives an extension full Chrome DevTools Protocol access — cookies, keystrokes, any page. Here's what it allows and how to check yours.
The webNavigation permission lets an extension watch every URL you open live — no host permissions, no injected code. Here's what it sees and how to check.
The management permission lets a browser extension list every other extension you've installed and toggle them off. Here's what it exposes and how to check.
Screen recorder extensions can reach your camera, mic and every tab. Here's the permission breakdown, the Screencastify webcam bug, and how to record safely.
The storage permission is the most-requested thing extensions ask for — 62% claim it, with no install warning. Here's what it keeps, where, and how to check.
The proxy permission lets a browser extension reroute all your traffic through servers it controls. Here's what it really allows — and how to check yours.
The unlimitedStorage permission lets extensions hoard data on your disk with no cap. ~687M users are exposed — and W3C is debating a limit on July 2, 2026.
The activeTab permission lets browser extensions touch the page you're on — only when you click, with no scary install warning. Here's what it grants.
The history permission lets a browser extension read every site you visited — even before you installed it. Here's what it exposes and how to check yours.
The webRequest permission lets browser extensions watch — and sometimes rewrite — every network request you make. Here's what it really sees and how to check.
An ACM study found 15.97% of extensions start third-party tracking within 60 seconds. Here's why the permission list never told you, and how to check.
I mapped browser extension permissions across 308,210 live listings: 62% claim storage, 7.4% can read every site you visit. Here's what to pause on.
Screenshot extensions can read every page they capture. Here's the permission breakdown, what the ShotBird hijack revealed, and how to grab screens safely.
An AI agent extension like OpenAI's Codex asks to 'read all data on all websites.' Here's what it really allows, why agents need it, and how to check yours.
The native messaging permission lets browser extensions talk to native apps outside Chrome's sandbox. Here's what it really enables — and how to check yours.
LinkedIn scanned 6,236 Chrome extensions to fingerprint users without consent. Here's how extension fingerprinting works and how to check if you're exposed.
The tabs permission lets Chrome extensions log every URL you visit in real time — no history permission needed. Here's what it does and how to audit yours.
18 extensions harvested meeting data from 2.2M users on Zoom, Teams, and Meet. Here's how video conferencing extension access works — and how to audit yours.
The scripting permission lets extensions run JavaScript on any page you visit — including your Zoom calls. Here's what that actually means for your privacy.
Browser extension host permissions let extensions read and change every website you visit. Here's what that warning actually means and when to be concerned.
The cookies permission lets extensions read, write, and delete cookies — including session tokens. Here's what that means for your accounts and how to check.
Over 200 extensions silently pull email from Gmail and Outlook. Here's how extension email access works and how to check which add-ons can read your inbox.
AI extension data collection is real: 52% of AI Chrome extensions collect user data. Here's what scripting permissions let them see, and how to check yours.