Chrome Permission Audit

Chrome 'identity' permission & OAuth tokens in AI browser extensions.

How does `chrome.identity` work in Chrome extensions? Learn the difference between basic email sign-in and broad Google Workspace OAuth scopes (Gmail, Drive, Sheets).

Best fit

Best for users and IT admins reviewing OAuth consent screens and identity permissions in Chrome extensions.

Technical Manifest Audit

Permission specification & risk profile.

Review how Chrome enforces identity / identity.email in Manifest V3 and how to tell legitimate user-triggered extensions apart from intrusive tools.

Risk level: Loweridentity / identity.email
Chrome install-time warning
"Know your email address" (or separate Google OAuth consent screen)
Manifest V3 declaration
{
  "manifest_version": 3,
  "permissions": ["identity"]
}
Legitimate uses vs. red flags
What to verify before granting this permission to an AI browser tool.

Legitimate AI reading uses

  • Authenticating a user's subscription tier without requiring a separate password
  • Launching a standard OAuth2 PKCE login flow via `chrome.identity.launchWebAuthFlow`

Red flags to watch for

  • Bundling broad Google Drive (`drive`), Gmail (`mail.google.com`), or Contacts OAuth scopes into a simple sign-in prompt
How Vezz me handles this: Vezz me does not request OAuth access to your Google Drive, Gmail, or Workspace files. You simply enter your email address in the extension to track your 10 free monthly answers or Pro subscription.
Step-by-step workflow

How to run this workflow in place.

1

Separate Chrome manifest permissions from OAuth scopes

The `identity` permission in `manifest.json` only enables the auth popup API. The actual data access is determined by the `oauth2.scopes` requested on the consent screen.

2

Audit every checkbox on Google OAuth screens

A login screen should only ask for `openid`, `email`, and `profile`—never access to read your Google Drive or Gmail unless that is the core product.

Key details

Why this approach works better than switching tabs.

Why Vezz me uses lightweight email identification
You shouldn't have to connect your Google Workspace OAuth tokens just to ask 10 free AI questions a month.
  • Enter any email address in the Vezz me popup to track usage and Pro status
  • Zero access to your Google account tokens, contacts, or cloud files
  • Subscription billing is handled directly by Stripe
Frequently asked questions

Common questions about chrome permission audit.

Does Vezz me ask for Google OAuth permissions?

No. Vezz me never asks for OAuth access to your Google account.

Related workflows & guides

Explore connected pages.

Google Docs & Workspace permissions
How AI Chrome extensions interact with Google Workspace.
Open guide
Google Sheets & report permissions
What permissions AI extensions ask for on spreadsheets.
Open guide
All Extension Security & Permissions
Browse the complete directory of extension security & permissions on Vezz me.
View hub directory
Available for Chrome and Firefox

Ready to try this workflow on your own reading?

Install Vezz me free, highlight text on any webpage, and press your customizable shortcut (default: Ctrl+Shift+X or Cmd+Shift+X on Mac) to get an answer right beside the source.

Install free for ChromeInstall free for FirefoxCompare plans