Permissions are restricted to essential functionality only

Overly broad permissions like <all_urls> give an extension read and write access to every website a user visits — every bank page, every login form, every private document. Chrome Web Store policy (chrome-cws-permissions-policy) enforces least-privilege; extensions with unjustified broad permissions fail review. Beyond review, broad permissions are the primary attack surface for supply-chain compromise: if your extension is hijacked, <all_urls> turns it into a credential harvester. OWASP A01 (Broken Access Control) and CWE-272 (Least Privilege Violation) both apply.

Audit every entry in permissions and host_permissions against your extension's actual functionality. Remove anything you don't use. Narrow broad host patterns to specific origins.

{
  "permissions": ["tabs", "storage"],
  "host_permissions": ["https://api.example.com/*"]
}

Replace <all_urls> with explicit origins. If you need content script access on user-initiated pages, use activeTab instead — it grants access only to the tab the user explicitly interacts with, without persistent broad permission.