Permissions are minimal and justified

CWE-250 (Execution with Unnecessary Privileges) is the direct consequence of over-broad Chrome extension permissions. Every extra permission listed in manifest.json expands your attack surface: a supply-chain compromise of one dependency can exfiltrate all browsing history if history is listed, or silently install other extensions if management is present. Chrome's permission-warning system means excessive permissions also trigger alarming install dialogs that depress conversion rates and erode user trust. OWASP A01 (Broken Access Control) governs this: the extension should operate with the minimum privilege necessary. Unused permissions discovered during Chrome Web Store review will block publication.

Audit every entry in manifest.json permissions against actual chrome.* API calls in the codebase. Remove any permission with zero call sites. Downgrade tabs to activeTab when the extension only acts on the current page at user request.

{
  "permissions": ["activeTab", "storage"]
}

For host access, prefer activeTab over static host permissions — it requests no install-time warning and grants access only when the user clicks the extension icon.