Chrome Extension Permissions — Why the Permissions Field Is Usually Empty
A Chrome extension's details page has two separate sections, Permissions and Site access. Across our own seven extensions the Permissions section was empty every time, so the only thing left to read was Site access. Where the broad warning actually comes from, and why identical wording can mean opposite things.
The details page for a Chrome extension has two separate sections: Permissions and Site access. I checked all seven of the extensions we build, and the Permissions section was empty in every one of them. Everything worth reading was in Site access, further down.
What I tested on
Everything below is what I saw on screen in this setup, and nothing beyond it.
- Chromium (the build bundled with Playwright, chromium-1234). Not Google Chrome itself
- Linux (WSL2), interface language set to Japanese
- The extensions were side-loaded as unpacked extensions. I did not check how a store-installed extension displays
- Checked on 2026-08-04
I used our own seven extensions because comparing the screen against the manifest only works if you already know what the manifest says.
Where to look
- Open
chrome://extensions - Open Details on the extension you care about
- Read the two sections: Permissions, then Site access
The Permissions section is empty more often than not
Between them, the seven extensions declare storage, scripting, contextMenus and activeTab. None of those four produced a line in the Permissions section. All seven came up empty.
So "the permissions list is blank, this one must be harmless" does not hold. A blank list is ordinary, not reassuring.
Site access has two possible wordings
Two, in this sample. Quoted as they appeared:
A — "Allow this extension to read and change all your data on websites you visit"
The extension can run on every page you open. Four of the seven showed this.
B — "This extension can read and change your data on sites. You can control which sites the extension can access."
This one is followed by "Automatically allow access on the following sites" and a list.
Where it gets confusing
Wording B can mean opposite things
The three extensions showing B had nothing in common once you read the list:
- Safe Privacy Mask — fifteen sites listed, and it runs automatically on those
- Safe Night Check — one entry,
https://mail.google.com/* - Copy & Prep — the list is empty
Copy & Prep is empty because it uses activeTab and ships no always-on content script. Same wording, and the number of sites it runs on by itself is zero.
Reading the sentence is not enough. The list underneath is the part that carries the meaning.
The manifest's host_permissions will not tell you either
This was the part I got wrong going in.
Safe Attachment Check declares **no host_permissions at all**, and it still showed wording A — character for character the same as Safe Privacy Gate, which does declare <all_urls> explicitly.
The cause is the matches patterns in content_scripts. Those count as host permissions for this purpose. Advice along the lines of "check host_permissions to see how broad an extension is" stops short of the answer.
The number of patterns declared is not the number shown
Safe Privacy Mask declares thirty match patterns; fifteen appeared on screen. Declaring both https://chatgpt.com/* and https://*.chatgpt.com/* shows only the broader https://*.chatgpt.com/*.
A short list does not mean narrow coverage.
What this does not tell you
- Whether the extension actually sends anything anywhere. Permissions describe what it is allowed to do, not what it does. Checking traffic is a separate exercise
- Broad access is not evidence of bad behaviour. Anything that inspects what you are about to send has to be able to run on the page you are sending from. Four of our own extensions are in group A for exactly that reason
- I did not look at the permission summary on a store listing, or at the confirmation dialog shown at install time
What to look at next
Site access tells you how wide the door is, not what goes through it. For an extension in group A, the next question is what it does with that reach.
If you want a quicker decision, check whether the access can be narrowed after the fact. The group A extensions offered "On click" and "On specific sites" alongside "On all sites". For an extension you only need in one place, setting that before you start using it is an option.