What's the difference between a permission and an API?
A permission is what an extension is allowed to do, granted by you at install or first use. An API is the actual programming interface, like chrome.tabs, that the extension calls once it holds that permission to carry out the action.
What does host permission actually let an extension do?
Host permission lets an extension read or change data on the websites it's granted access to, from a single domain up to every site you visit, which is why broad host access gets flagged separately on every listing.
Is Manifest V3 safer than Manifest V2?
Manifest V3 generally limits some of the more powerful, less controllable capabilities Manifest V2 allowed, particularly around network blocking and background scripts, though it isn't a guarantee that every Manifest V3 extension is automatically trustworthy.
What does sideloading an extension mean, and is it risky?
Sideloading means installing an extension from outside the Chrome Web Store, such as loading unpacked developer code. It skips the store's review process, so it carries more risk and is mainly used by developers testing their own work.
Why does an extension need the tabs permission just to work?
Some extensions, like tab managers or session savers, genuinely need to see your open tabs' titles and URLs to function. It's worth checking that a request matches the extension's stated purpose rather than assuming every request is necessary.
What is declarativeNetRequest and why do ad blockers use it?
It's a Manifest V3 API that lets an extension block or modify network requests using rules declared in advance, rather than inspecting every request in real time. Ad and content blockers rely on it to filter traffic under the newer platform.
Does a Featured badge mean an extension is safe?
No. A Featured badge shows an extension meets the Chrome Web Store's technical and policy guidelines, which covers things like quality and user experience, not a full security guarantee or endorsement of the developer's data practices.
What should I check in an extension's data collection disclosure?
Look at which categories of data it claims to collect, such as browsing activity or personal information, and compare that against what the extension actually needs to do its job before deciding whether the request feels proportionate.
What happens to an extension when its ownership changes hands?
A new owner can change permissions, monetization, or how data is handled, sometimes without users noticing right away. We flag ownership changes on Listing Health so you know to recheck a familiar extension after one occurs.
Why do extensions ask for optional permissions instead of everything up front?
Optional permissions let an extension request access only when you use a feature that needs it, rather than demanding everything at install. It's generally a sign of a more considered, minimal-access approach to permissions.
What does it mean if an extension is removed from the Chrome Web Store?
It usually means the extension violated store policy, was abandoned by its developer, or was voluntarily pulled. We flag listings that appear removed rather than leaving the page looking current and installable.
Where can I read more about a specific permission in depth?
Our permissions guide covers individual permissions such as host access, tabs, history, cookies, storage, downloads, clipboard, notifications, declarativeNetRequest, and scripting in plain-English, page-by-page detail, including what each one is used for.
