Chrome Permissions Checker

Chrome permissions checker

Short answer

A Chrome permissions checker lists the APIs and websites an extension can access and explains each one in plain language. It separates required permissions from optional ones and flags broad host access such as all_urls. Powerful permissions are not automatically malicious, but they define the extension's maximum reach.

Drop an extension package hereor choose a file from your deviceChoose a fileSupported: CRX, XPI, ZIP, manifest.json. Maximum size: 25 MB.

Processed locallyCode is never executed

Your file stays in this browser. Parsing happens in a Web Worker; the extension code is read, never executed.

What the scan checks

Permissions, host access, content scripts, background scripts, CSP, externally_connectable, web-accessible resources, JavaScript patterns, referenced domains and risk categories.

MV3MV2CRXXPIZIPJSON

Static analysis shows references and patterns. It cannot prove that network activity happened or that an extension is malicious.

Compare two versions

See permission, domain and finding changes between two packages.

Compare

Required versus optional permissions

Required permissions are granted at install time. Optional permissions must be requested later and may be refused by the user. A good extension asks for the minimum required access and requests optional capabilities only when a feature needs them.

The checker labels each permission as required or optional so you can see which capabilities were forced by installation.

API permissions and website access are different

The tabs permission concerns tab metadata and browser actions. A host permission concerns page URLs. The cookies permission concerns cookie storage. Reading them separately prevents a common mistake: assuming that a host permission alone grants cookie or history access.

The report shows both categories and highlights all_urls, http://*/*, https://*/*, debugger, nativeMessaging, proxy, management, cookies, history, webRequest, downloads and scripting.

How to interpret a broad permission

Ask three questions: Does the stated feature require this capability? Is the access limited to the sites the feature needs? Is the permission used in a way the publisher explains clearly? When the answer is unclear, look for an alternative extension with narrower access.

A permissions checker provides evidence, not intent. A broad permission can be necessary for a content blocker, accessibility tool or developer utility. The risk comes from the combination of access, data handling and transparency.

1
List the permissions
Upload the package and read the required and optional lists.
2
Match them to features
Each permission should map to something visible in the product.
3
Check the host patterns
Specific hosts are narrower than all_urls or wildcard schemes.
4
Review sensitive APIs
debugger, nativeMessaging, cookies and proxy deserve extra scrutiny.

Frequently asked questions

What is the most dangerous Chrome extension permission?

There is no single ranking because context matters. debugger, nativeMessaging, proxy and broad host access are among the highest-impact capabilities, and cookies, history and webRequest can expose sensitive data.

Does a permission mean the extension is using it?

No. A declaration is a capability. Static analysis can find references to related APIs, but only runtime monitoring or a code audit can show actual use.

Can an extension ask for more permissions later?

It can request optional permissions, and some updates can require new permissions. Review the permission prompt and the extension's changelog before accepting.

How do I check permissions after installing?

Open the browser's extension management page and inspect the extension details. This tool is for inspecting packages before or independently of installation.

Last reviewed: October 31, 2026

Or analyze from a store URL