Permission justification in manifest matches actual feature usage

When a manifest requests permissions that are never used in code, the extension presents a larger attack surface than necessary and violates the data minimization principle in GDPR Art. 5(1)(c). Reviewers at the Chrome Web Store explicitly audit permission-to-usage alignment — requesting history or cookies without a clear purpose triggers human review and is a common cause of rejection. CWE-272 addresses least privilege failure: granting more access than required means any future exploit, supply chain attack, or malicious update can leverage permissions that should never have existed. Without documented justification, neither users nor reviewers can verify that permissions are legitimate.

For each permission in manifest.json, add an inline comment explaining its purpose, then verify a matching API call exists in your code:

"permissions": [
  "storage",      // Store user preferences locally
  "tabs",         // Read current tab URL for page analysis
  "activeTab"     // Access focused tab on user action only
]

For any permission without a comment and a matching code reference, remove it immediately. If a permission was added for a planned feature, exclude it until that feature ships — you can re-request permissions in a future manifest version. Check usage with a project-wide search: if chrome.history appears nowhere in your source, history is unused.