Extension Security & Permissions

Chrome extension permissions explained: security audits for AI browser tools.

Understand what Chrome Manifest V3 permissions actually allow—from activeTab and scripting to <all_urls>, webRequest, and Google Sheets report overlays—before installing an AI extension.

Directory hub (27 guides)

Best for security-conscious users, IT admins, researchers, and teams evaluating the privacy and permission footprint of AI Chrome extensions.

Featured resources

Start with these foundational guides & packs.

Master checklist
Interactive Permission Checker Checklist
Our master 5-step audit matrix for evaluating any AI Chrome extension before installing.
Open resource
Security guide
AI Chrome Extension Privacy Checklist (Article)
Deep dive into data retention, model training policies, and page-context boundaries.
Open resource
All guides in this hub

Explore all 27 extension security & permissions.

Chrome Permission Audit
What is the activeTab permission in Chrome extensions? Security & privacy guide
Learn how Chrome's activeTab permission works in Manifest V3, why it displays no install warning, and how user-triggered AI extensions use it to protect your browsing privacy.
Read guide
Chrome Permission Audit
Chrome extension scripting permission explained: UI overlays vs security risks
What does the Manifest V3 'scripting' permission allow? Learn how AI Chrome extensions use chrome.scripting.executeScript to render answer panels and what to check before installing.
Read guide
Chrome Permission Audit
'Read and change all your data on all websites' (<all_urls>) permission explained
Why do AI Chrome extensions trigger the scary 'Read and change all your data on all websites' warning? Learn how to tell a safe on-screen reading tool from a data-harvesting extension.
Read guide
Chrome Permission Audit
Chrome webRequest & declarativeNetRequest permissions: why AI reading tools shouldn't need them
What do webRequest and declarativeNetRequest do in Chrome extensions? Learn why ad blockers need network interception—and why an AI reading assistant usually shouldn't.
Read guide
Chrome Permission Audit
Chrome 'tabs' permission vs activeTab: can AI extensions read your browsing history?
Understand why Chrome warns 'Read your browsing history' when an extension requests the 'tabs' permission—and how it differs from the history and activeTab permissions.
Read guide
Chrome Permission Audit
clipboardRead vs clipboardWrite permissions in AI Chrome extensions
Why do some AI extensions ask to 'Read data you copy and paste'? Learn the difference between one-click copy buttons (clipboardWrite) and background clipboard monitoring (clipboardRead).
Read guide
Chrome Permission Audit
Chrome extension 'storage' permission: local settings vs server-side data
What does the 'storage' permission do in Chrome extensions? Understand the difference between chrome.storage.local, chrome.storage.sync, and what AI extensions store on remote servers.
Read guide
Chrome Permission Audit
Chrome 'sidePanel' permission vs on-screen overlays: UX & privacy differences
Compare Chrome's native sidePanel API (used by Sider, Monica, and Copilot) with on-screen selection overlays like Vezz me—covering viewport space, context scope, and permissions.
Read guide
Specific Use-Case Security Audit
If an AI extension overlaps reports on the same sheet, what permission does it ask for?
When an AI Chrome extension overlays or summarizes reports on a spreadsheet or BI dashboard (Google Sheets, Airtable, Looker), which Chrome permissions does it require and how do you audit it safely?
Read guide
Specific Use-Case Security Audit
Auditing AI Chrome extension permissions for Google Docs, Notion, and enterprise wikis
Learn how AI Chrome extensions interact with Google Docs, Notion, Confluence, and internal knowledge bases—and how to configure Chrome host access and context controls safely.
Read guide
Chrome Permission Audit
Chrome 'contextMenus' permission explained: right-click AI actions vs keyboard shortcuts
What does the 'contextMenus' permission allow in Chrome extensions? Learn why it displays no install warning and how right-click menus compare with keyboard shortcuts like Ctrl+Shift+X.
Read guide
Chrome Permission Audit
Chrome 'cookies' permission: why AI reading extensions shouldn't need your session cookies
What does the Chrome 'cookies' permission allow? Learn why requesting cookie access across websites is a major red flag for AI browser extensions—and how safe tools authenticate instead.
Read guide
Chrome Permission Audit
Chrome 'history' permission vs 'tabs': can an AI extension read your past browsing log?
Learn the exact technical difference between Chrome's 'history' permission (which reads your past chrome://history database) and the 'tabs' permission—and how to audit AI extensions.
Read guide
Chrome Permission Audit
Chrome 'identity' permission & OAuth tokens in AI browser extensions
How does `chrome.identity` work in Chrome extensions? Learn the difference between basic email sign-in and broad Google Workspace OAuth scopes (Gmail, Drive, Sheets).
Read guide
Chrome Permission Audit
Chrome 'notifications' permission: why calm AI tools avoid desktop alert spam
What does the 'notifications' permission allow in Chrome extensions? Learn why background desktop notifications are unnecessary for in-page reading assistants.
Read guide
Chrome Permission Audit
Manifest V3 'offscreen' permission explained: DOM parsing vs hidden activity
Why did Chrome introduce the 'offscreen' permission in Manifest V3? Learn how extensions use offscreen documents for Readability parsing, audio, or clipboard tasks.
Read guide
Chrome Permission Audit
Chrome 'alarms' permission & background service workers in Manifest V3
What does the 'alarms' permission do in Chrome extensions? Understand the difference between event-driven user-triggered extensions and scheduled background polling.
Read guide
Chrome Permission Audit
Chrome 'declarativeContent' permission: conditional page actions explained
Learn how Chrome's declarativeContent permission lets extensions enable their toolbar icon on matching pages without reading page content in the background.
Read guide
High-Security Surface Audit
Auditing AI Chrome extensions on banking, brokerage, and accounting portals
Should you allow AI browser extensions on banking, brokerage, Stripe, or accounting dashboards? Learn how to use Chrome site-access controls, separate profiles, and Minimal context safely.
Read guide
High-Security Surface Audit
Browser extension security for clinical portals, EHRs, and healthcare research
How clinicians, medical students, and researchers can safely use AI Chrome extensions on public biomedical literature (PubMed, NCBI) while protecting PHI on clinical portals.
Read guide
Engineering Security Audit
Auditing AI Chrome extensions on private GitHub, GitLab, and internal codebases
How software engineers and AppSec teams audit AI browser extensions for reading documentation, public open-source repos, and internal pull requests without leaking secrets.
Read guide
Firefox Add-on Security Audit
Firefox Add-on permissions vs Chrome Manifest V3: security guide for AI tools
How Mozilla Firefox's WebExtension permission model, Data Collection disclosures, and `about:addons` controls work for AI reading extensions like Vezz me.
Read guide
Manifest V3 Network Rules
Chrome Extension declarativeNetRequest: How it works & why ad-blockers use it
Understand Chrome Manifest V3 declarativeNetRequest vs webRequest. Learn how browser-evaluated declarative rules protect privacy and why Vezz me needs neither.
Read guide
Clipboard Security Audit
Chrome Extension clipboardWrite: Copying answers without clipboard hijacking
Understand Chrome extension clipboardWrite permission vs clipboardRead. Learn how clipboard poisoning works and why Vezz me only writes what you explicitly click to copy.
Read guide
UI Architecture & Permissions
Chrome Extension sidePanel vs activeTab overlay: Viewport, focus & privacy
Comparing Chrome Manifest V3 sidePanel permission with in-page floating activeTab overlays. Learn why floating cards preserve reading flow better than 400px sidebars.
Read guide
Manifest V3 Script Execution
Manifest V3 chrome.scripting.executeScript: Code injection vs pre-injected scripts
Deep dive into Chrome Manifest V3 chrome.scripting vs persistent content_scripts. Learn why on-demand execution on user gesture is safer than running code on every page load.
Read guide
Enterprise Wiki Security Audit
Auditing AI browser extensions on Confluence, Notion, Jira & internal intranets
Why IT and InfoSec teams restrict AI Chrome extensions on internal wikis (Confluence, Notion, Jira, SharePoint) and how activeTab-only extensions comply.
Read guide
Explore other hubs

Browse all Vezz me knowledge hubs.

AI Extension Comparisons
Compare Vezz me with Sider, Monica, Merlin, HARPA AI, MaxAI, Glasp, SciSpace, and more.
Browse comparisons
Permission & Security Audits
Understand activeTab, scripting, host permissions, and Google Sheets AI permissions.
Browse permissions
AI Reading Workflows
How to explain API docs, research papers, SEC 10-Ks, legal clauses, and practice quizzes.
Browse use cases
Custom Prompt Preset Library
Download 1-click JSON prompt presets for Socratic study, ELI5, code review, and legal text.
Browse prompts
Platforms & Reader Personas
Guides for GitHub, arXiv, Stack Overflow, PubMed, Wikipedia, developers, and students.
Browse platforms
Questions

Frequently asked questions.

Why does Chrome warn that an AI extension can 'Read and change all your data on all websites'?

Chrome displays that standard warning whenever an extension requests broad host permissions or content scripts so its UI overlay can render on whichever webpage you are reading. Because Chrome's install warning cannot distinguish between a user-triggered reading tool and a silent background scraper, you must check whether the extension only transmits data when you press a shortcut.

What is the safest way to test a new AI Chrome extension?

Create a separate Chrome profile for testing, inspect the permissions requested at install time, set site access to 'On click' if supported, and verify in the privacy policy that selected text is only sent when triggered by the user.

How does Vezz me handle webpage permissions and privacy?

Vezz me runs on webpages so you can highlight text and see the answer panel directly on screen, but it only sends your selected text, question, and user-chosen page context level (Minimal, Basic, or Detailed) after you explicitly trigger the extension. It never logs your browsing history.

Available for Chrome and Firefox

Ready to try this workflow on your own reading?

Install Vezz me free, highlight text on any webpage, and press your customizable shortcut (default: Ctrl+Shift+X or Cmd+Shift+X on Mac) to get an answer right beside the source.

Install free for ChromeInstall free for FirefoxCompare plans