Internal help text explains why specific permissions are requested
Why it matters
Browser permission dialogs are terse and technical — users confronted with "This extension wants to read your browsing history" without any explanation default to denial or, worse, approval without understanding. GDPR Art. 12 requires privacy information to be provided in a concise, transparent, and easily accessible form. Without user-facing help text in the options page or popup, users cannot make informed choices about which permissions to allow, cannot verify that the extension's permissions match its stated purpose, and are more likely to distrust the extension or report it as suspicious. Transparent permission explanations are the difference between an extension users recommend and one they uninstall.
Severity rationale
Info because absent help text degrades user trust and informed consent rather than creating a direct technical vulnerability — but it is a signal that the extension has not considered privacy communication as part of its design.
Remediation
Add a "Permissions" section to your options.html explaining each non-trivial permission in plain language:
<section id="permissions-explainer">
<h3>Why we need these permissions</h3>
<dl>
<dt>Camera</dt>
<dd>Activated only when you start a video call. We never record without your action.</dd>
<dt>Storage</dt>
<dd>Your preferences are stored locally on this device. Nothing is sent to our servers.</dd>
<dt>Active Tab</dt>
<dd>We read the current page URL only when you click the extension icon.</dd>
</dl>
</section>
Keep explanations specific to what happens, not what the API is called. If a permission is used rarely, note when it activates.
DetectionPro
The detection method for this pattern is part of AuditBuffet Pro.
The full method (what to look for, pass and fail conditions, and how results get reported) ships inside the Extension Data Privacy Audit. The pattern definition, severity rationale, and remediation remain openly licensed under CC-BY-4.0.
External references
- gdpr · Art. 12 — Transparent information, communication and modalities for the exercise of rights
- external · chrome-web-store-user-data-policy — Chrome Web Store User Data Privacy Policy — Prominent Disclosure requirement
Taxons
History
- 2026-04-18·v1.0.0·Initial import from extension-data-privacy·automated