How to Check Chrome Extension Permissions Before Installing

How to check Chrome extension permissions before installing

Short answer

You can check permissions before installing by reading the extension's manifest.json from its package or store listing, then matching each declared permission and host pattern to the feature you need. The most important checks are broad host access, cookies, history, debugger, nativeMessaging and scripting.

Drop an extension package hereor choose a file from your deviceChoose a fileSupported: CRX, XPI, ZIP, manifest.json. Maximum size: 25 MB.

Processed locallyCode is never executed

Your file stays in this browser. Parsing happens in a Web Worker; the extension code is read, never executed.

What the scan checks

Permissions, host access, content scripts, background scripts, CSP, externally_connectable, web-accessible resources, JavaScript patterns, referenced domains and risk categories.

MV3MV2CRXXPIZIPJSON

Static analysis shows references and patterns. It cannot prove that network activity happened or that an extension is malicious.

Compare two versions

See permission, domain and finding changes between two packages.

Compare

Where to find the permission list

The Chrome Web Store detail page shows a permissions summary, but the package's manifest.json is more precise. A CRX, ZIP or unpacked folder contains the full list of required permissions, optional permissions and host permissions.

If you only have the store URL, paste it into the analyzer. When automatic retrieval is blocked, download the package and upload the file. Never install an extension just to inspect it.

A practical review order

Start with host permissions because they define which websites can be read or changed. Then look at content scripts, which may run on those sites. Review sensitive APIs next, and finish with optional permissions and the update URL.

Write down each capability and the feature that needs it. If you cannot connect a permission to a feature, that is the item to investigate.

1
Check host_access
Prefer specific hosts over wildcards and all_urls.
2
Check content_scripts
See which pages receive injected code.
3
Check powerful APIs
Review cookies, history, debugger, proxy, nativeMessaging.
4
Check optional permissions
Understand what may be requested later.

Permission warnings are not enough

Chrome's install prompt summarizes access, but wording can be broad and easy to dismiss. The manifest distinguishes optional from required access and shows the exact site patterns.

Use the install prompt for a quick check and the package analysis for detail. After installation, the browser's extensions page still lists granted permissions, and you can restrict site access.

Frequently asked questions

How can I see extension permissions without installing?

Download the CRX or ZIP and inspect manifest.json with a static analyzer. The Chrome Web Store page also shows a summary, but the manifest is more complete.

Which permission is the biggest privacy risk?

Context decides. debugger, nativeMessaging, proxy and broad host access have the widest reach, while cookies, history and webRequest can expose sensitive data.

Do optional permissions still matter?

Yes. They can be requested later and may expand access after installation. Review what the extension says it will ask for.

Can I limit an extension to one site?

Some browsers let you restrict site access for an installed extension. The extension's own host permissions still define what it is designed to access.

Last reviewed: October 31, 2026