Free tool
Extension Permission Checker
Paste a Chrome Web Store link to see exactly what an extension can do, read from the manifest inside the package itself rather than from the store description.
Why extension permissions matter more than app permissions
A phone app runs in a sandbox and asks before touching your camera or contacts. A browser extension with access to all sites has no equivalent boundary. It sits inside every page you open, after your password manager has filled your credentials and after your bank has rendered your balance. There is no second prompt at the moment it reads them.
This is why the resale problem is serious. An extension with a large install base is a valuable asset, and a buyer inherits every permission the original developer was granted, along with the ability to push an update to everyone silently. Several popular extensions have been sold and quietly repurposed exactly this way, which we cover in how Chrome extensions get compromised.
The permissions worth pausing over
| Permission | What it allows |
|---|---|
<all_urls> | Read and change every page you visit |
scripting | Inject arbitrary code into those pages |
cookies | Read session cookies, which can mean impersonating your logins |
tabs | See the URL and title of everything you open |
history | Read and modify your full browsing history |
nativeMessaging | Talk to programs installed on your computer, outside the browser |
management | Disable or uninstall your other extensions, including security ones |
debugger | Attach a debugger to any page, bypassing most protections |
How to judge what you see
The question is never whether the permission list is long. It is whether each entry is explained by what the extension claims to do. A screenshot tool needs to capture pages. A password manager needs to fill fields on every site. A currency converter that requests access to all sites, scripting and native messaging has asked for far more than converting currency requires, and that mismatch is the signal.
Manifest V3 narrowed some of this by removing the blocking web request API, which is why blockers migrated to declarative rules. It did not remove broad host access, so the calculation above is unchanged. We cover what did and did not change in Manifest V3 explained.
Our own extension, for comparison
ProBlocker requests access to all sites and scripting, and this tool scores it accordingly. That is the honest result: a blocker that could not see every site could not block anything. The difference we would point to is not a shorter permission list but that the source is published and the data practices are documented, so the capability can be checked against the behaviour rather than taken on trust.
Frequently asked questions
How do I know if a Chrome extension is safe?
Start with what it can do. Paste its Web Store link above and the tool reads the manifest inside the extension package, listing every permission Chrome grants it and every site it can read. An extension that asks for far more than its stated purpose requires is the clearest warning sign available before installing.
Why does this read the package instead of the Web Store listing?
Because the listing is rendered by JavaScript, so the permission text a visitor sees is not present in the page source at all. The extension package contains the manifest Chrome itself installs, which is authoritative and also exposes details the listing never shows, such as exact host patterns and content script matches.
Why do ad blockers score as high risk?
Because a content blocker has to see every site in order to filter it, which means requesting access to all sites. That is inherent to the category rather than suspicious. The tool says so when it detects blocking APIs. What separates a trustworthy blocker from an untrustworthy one is whether its source can be audited, not whether it requests broad access.
What is the most dangerous permission?
Access to all sites, combined with scripting. Together they let an extension read and rewrite any page you open, including your bank, your email and any internal system you use at work. Roughly speaking, an extension with both can do anything you can do in the browser.
Does a high score mean the extension is malicious?
No. Permissions describe capability, not behaviour. A high score means the extension could read your data, not that it does. The only way to know what it actually does is to read the source, which is why open-source extensions are easier to trust than equally-permissioned closed ones.