Manifest V3 Permissions List Explained

Manifest V3 permissions list explained

Short answer

Manifest V3 permissions declare which browser APIs an extension can use. Common examples include storage, tabs, cookies, history, scripting, webRequest, downloads, management, nativeMessaging and debugger. Host permissions live in a separate field and define which websites the extension can access. Each permission describes capability, not intent.

Drop an extension package hereor choose a file from your deviceChoose a fileSupported: CRX, XPI, ZIP, manifest.json. Maximum size: 25 MB.

Processed locallyCode is never executed

Your file stays in this browser. Parsing happens in a Web Worker; the extension code is read, never executed.

What the scan checks

Permissions, host access, content scripts, background scripts, CSP, externally_connectable, web-accessible resources, JavaScript patterns, referenced domains and risk categories.

MV3MV2CRXXPIZIPJSON

Static analysis shows references and patterns. It cannot prove that network activity happened or that an extension is malicious.

Compare two versions

See permission, domain and finding changes between two packages.

Compare

Common Manifest V3 permissions

The list below is a practical summary, not a complete browser API catalog. Browser support can vary, and new permissions are added over time. Always confirm the exact meaning in the vendor documentation before making a decision.

Common permissions and what they allow
Permission	Allows access to	Privacy consideration
storage	Extension-local and synced storage	May retain personal or browsing data
tabs	Tab titles, URLs, creation and closure	Reveals browsing activity
cookies	Cookie read and write access	Session cookies can grant account access
history	Browsing history	Highly revealing personal data
scripting	Code injection into permitted pages	Can read and change page content
webRequest	Observation of network requests	URLs and headers may contain tokens
downloads	Download initiation and file access	Review destinations and file types
management	Other extensions	Can disable or remove extensions
nativeMessaging	Communication with a native app	Reaches outside the browser sandbox
debugger	Deep tab and network inspection	Extremely powerful access
declarativeNetRequest	Rule-based request blocking or changes	Review bundled rule lists
alarms	Scheduled background tasks	Low risk alone; review task behavior

Where host permissions fit

Manifest V3 separates host permissions into host_permissions. A value such as https://example.com/* allows access to that host, while <all_urls> or *://*/* covers nearly every site. Content-script match patterns also define where injected code runs.

An extension can have API permission for tabs but no host access, or host access without a particular API. Read both fields together.

Optional permissions and updates

Optional permissions are listed separately and requested at runtime. They can expand access after installation, so check what the extension might ask for. Updates can also introduce new required permissions, which the browser may prompt you about.

Neither a permission list nor a store label tells you how data is handled. Combine the list with code evidence and the publisher's privacy policy.

Frequently asked questions

What is the difference between permissions and host_permissions in Manifest V3?

permissions grant API capabilities such as storage or cookies. host_permissions grant website access. Many privacy-sensitive features require both.

Is scripting more dangerous than tabs?

They expose different things. scripting can change page content where allowed, while tabs can reveal URLs and metadata. Context and host access determine impact.

Why do some permissions appear optional?

Optional permissions let an extension request a capability only when a feature needs it. Users can refuse them.

Does every Manifest V3 extension use host_permissions?

No. An extension without website access may request only API permissions, subject to browser rules.

Last reviewed: October 31, 2026