Chrome's install prompt is a summary, not a specification. It tells you an extension can "read your browsing history" or "change data on sites you visit", which sounds like a category of behaviour rather than a capability with edges. The manifest underneath is far more specific, and the gap between the two is where most bad surprises live.
Here is what several of the common permissions actually grant, in the terms the API grants them.
tabs
Reads the URL and title of every open tab, across every window, in real time. Not the tab you are looking at. All of them, continuously.
The honest use is a tab manager or a session saver. The abuse is building a record of which sites someone visits, which is browsing history by another route and does not require the history permission at all.
history
Reads, searches, adds to, and removes from the complete browsing history. Note the last two verbs. This permission is not read-only, so an extension holding it can also write entries and delete them.
cookies
Reads and modifies all cookies for matching domains, including authentication and session cookies. That is the sentence to sit with. A session cookie is, functionally, a logged-in session. An extension that can read them can generally act as you on those sites without ever seeing your password.
webRequest
Observes every network request and response for matching URLs, in real time, including bodies. Anything you submit in a form passes through this, in transit, before TLS ends at the browser rather than after.
clipboardRead
Reads the entire clipboard. Whatever was last copied is in scope, which for many people is a password out of a password manager, or a one-time code. This is the permission whose install prompt least resembles its capability.
proxy
Routes all browser traffic through a configured proxy. One permission, all traffic, including traffic to sites the extension has no host permission for.
management
Reads, and optionally uninstalls, other installed extensions. The read half is a fingerprinting surface, since an installed-extension list is fairly identifying. The uninstall half is what it sounds like.
downloads
Queries and erases download history, and can open the downloaded files themselves.
bookmarks
Reads and modifies the bookmark tree. Low drama compared to the others, but bookmarks are a reasonable proxy for what someone cares about.
How to read a permission list
Three questions get you most of the way. First, does the permission grant WRITE access as well as read, because several of them quietly do. Second, is the scope the current tab or every tab, since that distinction separates a useful tool from a surveillance one. Third, does the extension's stated purpose actually require this, because the mismatch between purpose and permission is the clearest signal available without reading the source.
An extension that needs activeTab and asks for tabs is telling you something. So is one that needs to style a single site and asks for host permissions on all of them.
For a breakdown of what a specific extension requests and why, Zovo on chrome extension permissions grant go through this per extension.