Every Chrome extension declares the permissions it needs in its manifest, and the install prompt summarises them in plain language. Most people click through. Here is how to actually read that prompt.
The phrases that matter
- "Read and change all your data on all websites" — the broadest grant. The extension can see and modify every page you visit, including banking and email. Justified for ad-blockers and password managers; a red flag for a single-purpose tool like a colour picker.
- "Read your browsing history" — the
historypermission. Reasonable for a tab manager, not for a PDF converter. - "Manage your downloads", "Read and change data you copy and paste" (clipboard), "Capture content of your screen" — each maps to a specific API. Ask whether the tool's job actually requires it.
Manifest V2 vs V3
V3 extensions must use host_permissions and can request access per-site at runtime instead of all-sites up front. An extension still demanding blanket <all_urls> access under V3, when it could ask per-site, is worth a second look.
A quick audit habit
Before installing, open the listing, check the permission list against what the tool claims to do, and skim recent reviews for "asks for too much." For a structured score of an extension's permission breadth and sensitive-API use, the tools and permission data at zovo.one are a useful reference point. The rule of thumb: the narrowest permission set that still does the job is the safest one.