Permission usage explanation provided in Notes to Reviewer
Why it matters
Chrome Web Store reviewers scrutinize permissions that appear broader than the extension's stated purpose. Without documented justification for each permission, reviewers must guess whether a permission is necessary — and they default to rejection when they can't. The chrome-cws-permission-justification best practice exists precisely because extensions are regularly removed for having permissions that look suspicious but are actually legitimate. Documenting every permission also surfaces over-permissioning during development, before it becomes a rejection.
Severity rationale
Medium because undocumented permissions slow review and increase rejection risk when reviewers cannot verify each permission is necessary.
Remediation
Create a PERMISSIONS.md or add a Permissions section to your README listing every manifest permission with a one-sentence justification.
## Permissions
| Permission | Why it's needed |
|---|---|
| `tabs` | Reads open tab titles and URLs to display them in the management UI |
| `storage` | Persists tab groups and user preferences locally |
| `activeTab` | Injects the tab-action UI into the currently focused tab on user click |
| `scripting` | Executes the tab group overlay script in response to user interaction |
Verify this table matches your manifest exactly — add every permission in permissions and host_permissions. During store submission, paste a condensed version of this table into the Notes to Reviewer field.
DetectionPro
The detection method for this pattern is part of AuditBuffet Pro.
The full method (what to look for, pass and fail conditions, and how results get reported) ships inside the Chrome Web Store Readiness Audit. The pattern definition, severity rationale, and remediation remain openly licensed under CC-BY-4.0.
External references
- external · chrome-cws-permission-justification — Chrome Web Store — Permission Justification in Developer Notes
Taxons
History
- 2026-04-18·v1.0.0·Initial import from extension-store-readiness·automated