Chrome extension permissions: control site access

A small browser extension can ask for surprisingly broad access. You install something to highlight a paragraph or tidy a webpage, then Chrome asks whether it can read and change data on the sites you visit.

Start by matching the extension’s access to the job you use it for. A tool you invoke occasionally may work with click-to-run access. A tool for one website may suit a restricted site list. Automatic access across many sites needs a reason you understand and a publisher you trust.

Chrome has offered these choices since Chrome 70 . This guide explains the desktop controls available on 23 February 2024, with Windows instructions and an illustrative example you can adapt to your own extensions.

What “read and change your data” means

An extension can use a small program called a content script to work inside an allowed webpage. Chrome’s content-script documentation explains that these scripts can inspect page content, alter it and pass information back to the extension.

That makes useful features possible. A highlighter needs to identify the text you select. A reading tool may change how the article appears. The permission gives the extension a capability; its implementation determines how it uses that capability.

Treat access to a sensitive page seriously. Chromium’s security explanation explicitly discusses access to information such as emails and passwords when the necessary permissions have been granted. It also explains why legitimate tools, including password managers, can need that access.

A broad request therefore deserves investigation, but does not establish that the extension is malicious. Ask a concrete question: does this tool need to work on the pages I am allowing it to read?

Find the permissions for an installed extension

You can review what you already have without installing another tool.

In Chrome’s address bar, type chrome://extensions and press Enter.
Find the extension you want to inspect and select Details.
Read its permissions and look for Site access.
Note the current setting before changing it. If there is a list of permitted websites, review those addresses too.

These controls are documented in Chrome’s host-access guide , with the labels preserved in its February 2024 interface source .

Start with an extension you rarely use. It is easier to judge whether an old shopping helper still earns its place than to begin by disrupting a tool you depend on every day. On a work or school browser, ask your IT team about extensions or settings managed by the organisation.

Choose when the extension can access websites

For an extension that requests broad website access, the three settings serve different purposes:

Setting	What it permits
On click	Temporary access to a requested website when you invoke the extension there.
On specific sites	Automatic access on the sites you allow. Other requested sites still require a manual grant.
On all sites	Automatic access across the websites the extension has requested.

“All sites” remains bounded by the extension’s requested access and Chrome’s restrictions. The setting does not grant an extension every possible browser capability. Some extensions request only particular websites, so their available controls can differ.

The behaviour above comes from Google’s host-permission guide .

For an occasional page tool, try requiring a click. For something you use on a handful of websites, try allowing those sites. If a feature needs to operate automatically wherever you browse, consider whether its benefit justifies that wider access.

Choose website access for the features you actually use. If the extension cannot work with the access you are willing to grant, consider whether to keep it.

Temporary access can last beyond one click

Click-to-run access is useful, but the grant does not necessarily end when an extension’s popup closes.

Chrome’s activeTab documentation describes temporary access tied to the tab. It can continue as that tab moves between pages with the same origin: the same protocol, hostname and port. Navigating that tab to another origin, or closing it, ends this temporary grant. A page reload does not necessarily end it.

For example, suppose you activate a page tool at https://example.com/article. Moving to https://example.com/account in the same tab keeps the same origin, so the temporary access can continue. A different path is not a fresh permission boundary.

This matters when deciding where to invoke an extension. Use it only on pages you are comfortable letting it inspect. Closing a popup is not a way to withdraw access, and ending a grant cannot undo information already read.

Worked example: a highlighter you use on two sites

Imagine a hypothetical highlighter that offers to remember marked passages across many websites. You only want it for a documentation site and a recipe site.

First, decide what you expect it to do. Do you want old highlights to appear automatically when you return, or are you happy to activate the tool yourself? That difference helps you choose an access setting.

Try this sequence on ordinary pages without sensitive information:

Record the highlighter’s existing access setting and the two sites where you need it.
Change its access to require a click, then open a fresh page on one of those sites.
Invoke the highlighter and try marking a short passage. Follow a reload prompt if Chrome shows one.
Close that tab and reopen the page. Check whether the behaviour still suits your routine.
If you want automatic highlighting on those two sites, select the restricted-site option and add their addresses. Retest the feature.

Some extensions need a reload after a permission grant, as Google explains in its host-access documentation .

If highlighting fails, check the extension’s own guidance. It may need another site involved in its service, or it may not support your preferred restricted setup. You can restore the setting you recorded, choose another tool, or decide the convenience is not worth the access.

A successful test tells you that the feature works with your chosen settings. It does not prove what the publisher does with information the extension can access. That requires a separate look at its disclosures.

Site access does not revoke every other permission

Chrome distinguishes website access from permissions for browser features . This is the part of an extension review that is easy to miss.

For example, a bookmark manager may have permission to read and edit saved bookmarks. Restricting the websites it can work on does not remove that separate bookmark capability.

Also look for access involving downloads, browsing information or the clipboard. Google’s permission-warning guidance describes these as distinct permissions. It also notes that some warnings are combined or suppressed alongside broader permissions, so a short warning list is not a complete technical inventory.

You do not need to decode every API name. You do need a satisfactory explanation for capabilities that seem unrelated to your task. A setting for website access cannot resolve discomfort about an extension’s access to your bookmarks.

Check Incognito and local-file access separately

The details page also has separate controls for access to Incognito browsing and file URLs, where applicable. Chrome’s permission documentation describes both.

Leave these disabled unless you need the extension in those contexts. If you allow it in Incognito, private browsing does not prevent that extension from recording information it can access. Chromium documents that Incognito limitation .

Check the publisher as well as the permission

Before keeping or installing an extension, read what its publisher says it collects, why it needs that information and whether it sends information elsewhere. Look for an identifiable developer, a relevant privacy policy and a clear explanation of the feature you want.

If the explanation is vague, ask whether another tool can do the job with a scope you are more comfortable with. “It needs access because it is an extension” is not a useful answer to a specific question about your data.

Chrome Web Store badges provide additional context. Google’s April 2022 announcement distinguishes them:

Featured indicates manual assessment against technical practices, user experience, design and listing standards.
Established Publisher indicates a verified publisher identity and a positive record of policy compliance.

Use those signals alongside the permissions and the publisher’s explanation. They are not a guarantee about every future version. Google has acknowledged that store review cannot catch every instance of abuse .

Pay attention when an existing extension asks for more access, too. Chrome can disable an updated extension pending approval when a newly added permission triggers a warning. The permission-warning documentation explains that process. Read the request and the developer’s reason before accepting it.

Remove extensions you no longer need

An extension left over from one task still needs a decision. If you no longer use it, open the extensions page and remove it. If you are checking whether it causes a problem, disabling it can help you compare the browser’s behaviour.

After disabling or removing an extension, close the webpages where it was active and reopen what you need. Chromium explains that already-injected scripts can remain in loaded pages . Removal also cannot retrieve information already sent to another server, and some changes to website data can persist.

For an ordinary permissions review, finish by checking that the setting you chose is saved and the feature still works. For every extension you keep, you should be able to say what you use it for, where it needs access and why you trust it with that access.

Sources and further reading

For the technical details behind these controls: