{"slug": "8-shipped-chrome-extensions-4-ways-to-declare-host-permissions", "title": "8 Shipped Chrome Extensions, 4 Ways to Declare Host Permissions", "summary": "A developer who ships eight Chrome extensions under Legacy Tools has identified four distinct patterns for declaring host permissions in Manifest V3. The survey of the eight manifests shows that five extensions use broad access via <all_urls> or content_scripts.matches, one is Gmail-only, one uses a fixed list plus optional grants, and one relies solely on activeTab. The developer notes that permission declarations act as user-facing UI, and that moving breadth from host_permissions to content_scripts does not reduce the site-access warning.", "body_md": "I ship eight small Chrome extensions under Legacy Tools. They are all\n\nManifest V3, and they all need some form of access to the pages you\n\nvisit — that is what tools that check things before you send them do.\n\nI have written before about [the rules I give AI agents](https://dev.to/k-wada/after-shipping-8-chrome-extensions-these-are-the-5-rules-i-always-give-ai-agents-13al)\n\nso they never broaden permissions on their own. This post is about the\n\nother side of that: the shapes the declarations themselves take.\n\nRecently I put all eight manifests side by side (the versions shipped to\n\nthe Chrome Web Store as of 2026-08-22) and realized they ended up using\n\nfour different shapes to declare that access. None of this was planned\n\nup front; each shape fell out of what the tool is. Here is the survey.\n\n**1. Everywhere, all the time — five extensions.**\n\nSafe Privacy Gate, Safe Attachment Check, Safe Mail Link Check, Site\n\nOperator Check, Find My Age. These step in right before a send or a\n\nclick, and there is no way to know in advance which site that will\n\nhappen on. Interesting detail: only two of the five actually write\n\n`<all_urls>`\n\ninto `host_permissions`\n\n. The other three get the same\n\nbreadth from `content_scripts.matches`\n\nalone.\n\n**2. One fixed site — one extension.**\n\nSafe Night Check is a Gmail-only tool, so the whole declaration is a\n\nsingle pattern: `https://mail.google.com/*`\n\n.\n\n**3. A fixed list plus optional grants — one extension.**\n\nSafe Privacy Mask enumerates thirty `matches`\n\npatterns for the AI chat\n\nsites it supports, and puts `<all_urls>`\n\ninto\n\n`optional_host_permissions`\n\nso that any other site is granted only when\n\nthe user adds it, one prompt at a time.\n\n**4. activeTab only — one extension.**\n\nWhile checking what these declarations look like from the user's side\n\n(on `chrome://extensions`\n\n, with the extensions side-loaded into\n\nChromium), two things stood out:\n\n`storage`\n\n,\n`scripting`\n\n, `contextMenus`\n\nand `activeTab`\n\n— none of those produces\na line in that box. \"The permissions list is blank, so it must be\nharmless\" is not a read you can make.`matches`\n\ncounts as a host permission.`host_permissions`\n\nat all, and its site-access wording\nwas character-for-character identical to Safe Privacy Gate, which\ndeclares `<all_urls>`\n\nexplicitly. You cannot shrink the warning by\nmoving breadth out of `host_permissions`\n\nand into `content_scripts`\n\n.Permission declarations are not configuration. They are UI — shown to\n\nthe user, in their words, at install time and on the details page. The\n\nshape you choose is a product decision: `<all_urls>`\n\nis honest for a\n\ntool that must work everywhere, a fixed list is honest for a\n\nsingle-site tool, and `activeTab`\n\nis worth the extra design work when\n\n\"only when I ask\" is the actual contract.\n\nI wrote up the longer versions of both halves of this:", "url": "https://wpnews.pro/news/8-shipped-chrome-extensions-4-ways-to-declare-host-permissions", "canonical_source": "https://dev.to/k-wada/8-shipped-chrome-extensions-4-ways-to-declare-host-permissions-3n1c", "published_at": "2026-08-21 17:16:55+00:00", "updated_at": "2026-08-21 17:44:52.136563+00:00", "lang": "en", "topics": ["developer-tools"], "entities": ["Legacy Tools", "Chrome Web Store", "Safe Privacy Gate", "Safe Attachment Check", "Safe Mail Link Check", "Site Operator Check", "Find My Age", "Safe Night Check"], "alternates": {"html": "https://wpnews.pro/news/8-shipped-chrome-extensions-4-ways-to-declare-host-permissions", "markdown": "https://wpnews.pro/news/8-shipped-chrome-extensions-4-ways-to-declare-host-permissions.md", "text": "https://wpnews.pro/news/8-shipped-chrome-extensions-4-ways-to-declare-host-permissions.txt", "jsonld": "https://wpnews.pro/news/8-shipped-chrome-extensions-4-ways-to-declare-host-permissions.jsonld"}}