Chrome Extension Permissions: How to Check Them Before You Install

CRX Starter Team · Updated Oct 31, 2026 · 7 min read

Short answer

Chrome extension permissions live in the package’s manifest.json: permissions, host_permissions and content_scripts. Read them yourself, or drop the package on CRX Starter, which lists them before installing. Group them into sites it can access, browser features it uses and its own settings, then ask: does that match the job it claims to do?

Chrome’s install prompt says things like "Read and change all your data on all websites". It’s accurate, but it doesn’t tell you whether that’s normal for the extension in front of you. A page translator needs every site. A notes app doesn’t.

This guide explains each permission a Chrome extension can ask for, shows how to read them before it’s installed, puts them into three plain groups, and helps you decide with one question: does what it uses match what it’s for?

On this page

What you need
Steps
Chrome extension permissions table
Without CRX Starter: reading manifest.json yourself
Questions worth asking
Questions

What you need

The extension package (.crx or .zip)
CRX Starter — or a text editor if you’d rather read manifest.json yourself

Steps

1
Drop the package and stop at the check
Drop the .crx or .zip into the CRX Starter workbench. It reads the manifest and stops at the check, with the progress list on "Waiting for you". Nothing is installed yet, and Cancel throws the check away. Packages that arrive from an install link start with the check folded into one line, such as "Needs access to 1 site · 1 browser feature" — click Show details to open it.
2
Read the three groups
Sites it can access. On these sites it can read and change page content. These come from host_permissions and content_scripts. If the extension asks for every site, the group shows "Every site" instead of a long list.
Browser features it uses. It calls these built-in browser features — for example tabs, cookies, downloads, history or scripting. Each one is listed by its manifest name.
Its own settings only. Used to keep its own settings and data: storage, alarms, notifications, contextMenus, sidePanel and similar.
CRX Starter doesn’t score or color any of these. Every group looks the same, however wide it is; the counts and names are there for you to read.
3
Match what it uses to what it’s for
Here are the three packages we use as examples on this site. Ticket Peek previews support tickets: one site (the support desk), one browser feature (tabs), and storage for itself. That fits its job. Shelf Notes is a side-panel notebook: storage and sidePanel only — no sites, no browser features. Exactly what you’d expect. Page Clipper says it saves articles for later, but asks for all sites plus downloads. A clipper might need the page you clip, but every site all the time plus your downloads is more than the description explains. That gap is the moment to stop and ask the author why.

Chrome extension permissions table

Each permission a Chrome extension can request, the group CRX Starter puts it in, and what it lets the extension do, in plain words.

Permission	Group	What it can do
A specific site, e.g. https://support.acme-desk.example/*	Sites	Read and change pages on that site
content_scripts matches	Sites	Run its scripts on the sites listed
<all_urls>, :///, http(s):///*	Sites (shown as “Every site”)	Read and change every site you open
activeTab	Browser features	Read the current page after you click it
tabs	Browser features	See the titles and addresses of your open tabs
scripting, webNavigation	Browser features	Inject scripts into pages it can reach; see where tabs navigate
cookies	Browser features	Read and change cookies, including sign-in sessions
downloads	Browser features	Start, read and manage your downloads
history, bookmarks	Browser features	Read your browsing history or bookmarks
webRequest, proxy	Browser features	Watch or reroute your network traffic
identity, management, privacy	Browser features	Use your Google identity, manage other extensions, change privacy settings
debugger, nativeMessaging	Browser features	Control pages like DevTools; talk to programs on your computer
clipboardRead, clipboardWrite, geolocation	Browser features	Read or write your clipboard; get your location
storage, unlimitedStorage	Own settings	Save its own settings and data
alarms, idle	Own settings	Run on a timer, notice when you’re away
notifications	Own settings	Show system notifications
contextMenus	Own settings	Add items to the right-click menu
sidePanel, offscreen, i18n	Own settings	Show its own panel and pages, translate its own text

Without CRX Starter: reading manifest.json yourself

Rename a .crx to .zip (or open the .zip) and open manifest.json in any text editor. Three keys matter: permissions (browser features and its own settings, such as tabs or storage), host_permissions (which sites it can access) and content_scripts → matches (which sites its scripts run on). Also check optional_permissions and optional_host_permissions: the extension can ask for these later. Sort each entry into the groups in the table above. To browse the rest of the files too, open the .crx like a ZIP.

What the check adds. Besides the three groups, the check shows where the package came from, whether it can update itself, and a "May not work" line for permissions CRX Starter can’t pass through yet, such as bookmarks, history and debugger, or file:// pages.

Questions worth asking

Does it ask for all sites, when it only works on one?
Does it use cookies, history or webRequest, when its job has nothing to do with your browsing?
Does it use nativeMessaging or debugger, and do you know who made it?
Does a new version ask for more than the last one — and does the changelog say why?
Can you name the author, and reach them if something goes wrong?

None of these proves an extension is malicious, and a short permission list doesn’t prove it’s safe. Where the file came from still matters most — more on that in is a .crx file safe?

Check before you install

Drop any .crx or .zip into CRX Starter and read the label first. Cancel costs nothing.

Add to Chrome — It's Free

Questions

Why does CRX Starter ask for "access to websites" for some packages?

So the package can reach the network, CRX Starter asks for website access for itself. That one belongs to the host, isn’t counted in the groups above, and the check says so in a footnote.

What does "May not work" mean?

Some Chrome features — bookmarks, history and the debugger among them — can’t be passed through to a package running inside CRX Starter yet, and neither can file:// pages. Features that need them may do nothing; everything else works.

Can a Chrome extension ask for more permissions later?

Yes, in two ways. Permissions listed under optional_permissions or optional_host_permissions can be requested while it runs, and Chrome asks you then. And an update can add permissions; Chrome disables the extension until you accept them.

Why doesn’t CRX Starter rate packages as risky or safe?

Because a permission list can’t tell good intent from bad. The same "all sites" permission powers a translator and a tracker. CRX Starter lists what a package uses, plainly, and leaves the judgement to you.