Overly broad permissions like <all_urls> give an extension read and write access to every website a user visits — every bank page, every login form, every private document. Chrome Web Store policy (chrome-cws-permissions-policy) enforces least-privilege; extensions with unjustified broad permissions fail review. Beyond review, broad permissions are the primary attack surface for supply-chain compromise: if your extension is hijacked, <all_urls> turns it into a credential harvester. OWASP A01 (Broken Access Control) and CWE-272 (Least Privilege Violation) both apply.
Critical because unjustified `<all_urls>` grants full read/write access to all sites the user visits, enabling credential theft on account takeover if the extension is compromised.
Audit every entry in permissions and host_permissions against your extension's actual functionality. Remove anything you don't use. Narrow broad host patterns to specific origins.
{
"permissions": ["tabs", "storage"],
"host_permissions": ["https://api.example.com/*"]
}
Replace <all_urls> with explicit origins. If you need content script access on user-initiated pages, use activeTab instead — it grants access only to the tab the user explicitly interacts with, without persistent broad permission.
ID: extension-store-readiness.policy-compliance.permissions-minimal
Severity: critical
What to look for: Examine the permissions and host_permissions arrays in the manifest. For each permission, verify it is necessary for the extension's stated purpose. Check for overly broad host permissions (e.g., <all_urls>, http://*/*, https://*/*) that could suggest the extension accesses data beyond what's needed.
Pass criteria: Enumerate all permissions in permissions and host_permissions arrays. Count the total. All declared permissions are justified by the extension's functionality. 0 unnecessary broad permissions found. Permissions are as specific as possible (e.g., https://example.com/* instead of <all_urls>). Report even on pass: "N permissions declared, all justified."
Fail criteria: At least 1 permission includes unnecessary broad access (e.g., <all_urls> for a tab manager that doesn't need it), or permissions don't match the stated purpose. Do not pass if <all_urls> is present without clear justification in the extension's core functionality.
Cross-reference: For broader security review of extension permissions and data access patterns, the API Security audit covers authentication and authorization practices.
Skip (N/A) when: Never — permission minimization is a Chrome Web Store policy requirement.
Detail on fail: Specify overly broad or unnecessary permissions. Example: "Permission <all_urls> requested but extension only manages tabs (doesn't need to access website content)" or "cookie permission declared but extension has no cookie-related functionality".
Remediation: Remove unnecessary permissions. Narrow broad permissions:
{
"permissions": ["tabs", "storage"],
"host_permissions": ["https://example.com/*"]
}
Only request permissions you actually use. tabs for tab management, storage for data persistence, scripting for content scripts, etc. Avoid <all_urls> unless absolutely necessary.