Chrome Extension Permissions Cheatsheet: The Complete Manifest V3 Reference (2026)

Extensions that request fewer permissions get 30% higher install rates. Yet 86% of popular Chrome extensions still request high-risk permissions they don’t need.

This cheatsheet gives you the full Chrome extension permissions list for Manifest V3 — organized by risk level, with the exact warning text users see, and clear guidance on when to use each one.

Bookmark it. You’ll come back to it every time you touch manifest.json.

How Permissions Work in Manifest V3

Chrome extensions declare permissions across four keys in manifest.json:

Rule of thumb: If a feature works without it on first launch, make it optional.

{
  "permissions": ["storage", "alarms"],
  "optional_permissions": ["bookmarks", "history"],
  "host_permissions": ["https://api.yourservice.com/*"],
  "optional_host_permissions": ["https://*/*"]
}

Permissions That Trigger NO Warning

These are safe to include in permissions — users won’t see any install-time warning.

Pro tip: activeTab + scripting replaces broad host permissions for most use cases. Use this combo instead of <all_urls>.

Permissions That Trigger Warnings

These permissions show a warning dialog at install. Each additional warning reduces your install conversion rate.

Browser Data Access

User Data Access

System & Capture

Browser Settings

Network Control

Accessibility

Host Permissions: Match Patterns

Host permissions control which websites your extension can interact with via fetch(), content scripts, and cookies.

Warning text for broad patterns: “Read and change all your data on all websites”

// ❌ Don't do this unless absolutely necessary
"host_permissions": ["<all_urls>"]

// ✅ Scope to what you actually need
"host_permissions": ["https://api.yourapp.com/*"]

// ✅ Even better — request at runtime
"optional_host_permissions": ["https://*/*"]

Decision Flowchart: Required vs Optional

Use this to decide where each permission belongs:

1. Is it needed for the extension to function at all? → permissions
2. Is it needed only for a secondary feature? → optional_permissions
3. Do you need access to a specific API domain? → host_permissions
4. Do you need access to user-visited sites, but only sometimes? → optional_host_permissions
5. Do you just need the current tab when user clicks your icon? → Use activeTab instead

Requesting Permissions at Runtime

For optional permissions, use the chrome.permissions API:

// Request when the user activates a feature
document.getElementById('enable-bookmarks').addEventListener('click', async () => {
  const granted = await chrome.permissions.request({
    permissions: ['bookmarks']
  });

  if (granted) {
    loadBookmarks();
  } else {
    showWhyPermissionHelps();
  }
});

// Check current permissions
const current = await chrome.permissions.getAll();
console.log(current.permissions); // ["storage", "alarms"]
console.log(current.origins);     // ["https://api.example.com/*"]

// Remove permissions you no longer need
await chrome.permissions.remove({
  permissions: ['history']
});

Privacy-First Permissions Checklist

Before publishing, audit your manifest.json:

• Remove unused permissions — audit your code for actual API usage
• Move non-essential permissions to optional_permissions — reduce install friction
• Replace <all_urls> with specific domains — or use optional_host_permissions
• Use activeTab instead of tabs — unless you need background tab URLs
• Explain each permission in your Chrome Web Store listing description
• Test with zero optional permissions — ensure core functionality works

Common Mistakes That Get Extensions Rejected

Quick Reference: Permission → API Mapping

Key Takeaways

1. Fewer permissions = more installs. Every warning you trigger costs you users.
2. activeTab is your best friend. It covers most tab-access needs without a warning.
3. Make it optional when you can. Runtime permission requests convert 30% better than install-time warnings.
4. Scope host permissions tightly. <all_urls> is almost never necessary.
5. Audit regularly. Permissions creep happens — remove what you’re not using.

Use Ext Review to analyze any Chrome extension’s permissions and security posture before installing — or to benchmark your own extension against competitors.