activeTab is prioritized over static permissions

Static host permissions show a scary install-time warning ('Read and change your data on specific websites') and persist even when the user hasn't triggered the extension. activeTab, by contrast, grants temporary access only to the tab that is active at the moment the user explicitly invokes the extension — no persistent grant, no install warning, and no access to background tabs. CWE-250 governs this: a static host permission is an execution privilege that persists indefinitely, while activeTab is just-in-time. Chrome's published permission guidelines strongly prefer activeTab for any user-gesture-driven workflow.

Replace static host permissions with activeTab in manifest.json for any functionality triggered by a browser-action click, context menu item, or keyboard shortcut.

{ "permissions": ["activeTab"] }

Then in your background script, call chrome.tabs.query({ active: true, currentWindow: true }) inside the action click handler — the activeTab grant is available only within that user gesture's event scope.