Review browser extensions before enterprise deployment

Reading a manifest helps prepare an extension review: which APIs are requested, for which sites, and when? A declaration describes requested scope. Effective access also depends on granted permissions, browser settings, policies and executed code.

Editorial selection of 20 Chrome permissions, with names checked against official documentation on 23 October 2026. Capabilities and questions are CIE synthesis. This is neither the complete permission list nor an official risk scale; it does not automatically apply to Firefox or every Edge version.

Five declarations with different meanings

Google Chrome · Declare permissions · Documentation consulted 2026-10-23; browser behaviour remains version-dependent

Google Chrome · Permissions API · Documentation consulted 2026-10-23; browser behaviour remains version-dependent

20 permissions: capabilities and evidence to review

Google Chrome · Permissions · Documentation consulted 2026-10-23; browser behaviour remains version-dependent

Hosts, paths and context: five reference points

Google Chrome · Match patterns · Documentation consulted 2026-10-23; browser behaviour remains version-dependent

Google Chrome · activeTab · Documentation consulted 2026-10-23; browser behaviour remains version-dependent

Google Chrome · Content scripts · Documentation consulted 2026-10-23; browser behaviour remains version-dependent

Local V3 manifest reader

Paste a Manifest V3 JSON manifest to inventory permissions and site declarations. Processing stays in this page: no installation, site request, local persistence, text transmission or export. Examples are fictional and illustrate result interpretation.

Limited to 64 KiB UTF-8, 200 declarations, 20 content_scripts blocks and 2,048 characters per value. The reader examines four permission lists and static scripts’ matches and exclude_matches. It retains every occurrence with its path. It does not validate pattern syntax, Chrome rules, installation warnings, globs, frames, code files, network rules, OAuth tokens, policies or granted access. Out-of-scope top-level keys are reported without reading their values; JSON accepted here can still be rejected by Chrome. For repeated JSON keys, JSON.parse retains the last value; review the original file to resolve ambiguity.

Eight examples available without JavaScript

{
    "manifest_version": 3,
    "name": "CIE fictional review example",
    "version": "1.0.0",
    "permissions": [
        "activeTab",
        "scripting",
        "storage"
    ]
}

{
    "manifest_version": 3,
    "name": "CIE fictional review example",
    "version": "1.0.0",
    "permissions": [
        "cookies",
        "webRequest"
    ],
    "host_permissions": [
        "<all_urls>"
    ]
}

{
    "manifest_version": 3,
    "name": "CIE fictional review example",
    "version": "1.0.0",
    "permissions": [
        "storage"
    ],
    "optional_permissions": [
        "history"
    ],
    "optional_host_permissions": [
        "https://*/*"
    ]
}

{
    "manifest_version": 3,
    "name": "CIE fictional review example",
    "version": "1.0.0",
    "content_scripts": [
        {
            "matches": [
                "https://*.example.org/*"
            ],
            "exclude_matches": [
                "https://private.example.org/*"
            ],
            "js": [
                "content.js"
            ],
            "run_at": "document_idle"
        }
    ]
}

{
    "manifest_version": 3,
    "name": "CIE fictional review example",
    "version": "1.0.0",
    "permissions": [
        "alarms"
    ],
    "host_permissions": [
        "https://intranet.example.org/private/*"
    ]
}

{
    "manifest_version": 3,
    "name": "CIE fictional review example",
    "version": "1.0.0",
    "permissions": [
        "identity",
        "nativeMessaging"
    ],
    "background": {
        "service_worker": "worker.js"
    },
    "oauth2": {
        "client_id": "fictional.apps.example.invalid",
        "scopes": [
            "fictional-scope"
        ]
    },
    "externally_connectable": {
        "matches": [
            "https://portal.example.org/*"
        ]
    }
}

{
    "manifest_version": 3,
    "name": "CIE fictional review example",
    "version": "1.0.0",
    "permissions": "tabs"
}

{
    "manifest_version": 2,
    "name": "CIE fictional legacy example",
    "version": "1.0.0",
    "permissions": [
        "https://*/*",
        "tabs"
    ]
}

Turn reading into a verifiable decision

1. Fix the purpose and scope

   Record extension identifier, publisher, distribution source, version, browser and test endpoint. Connect each capability to a task and affected data.

2. Compare requested, granted and observed

   Record manifest declarations, profile access choices and applied policies, then observe gestures and traffic using test data. These three levels are not interchangeable.

3. Repeat after change

   Compare versions, permissions, hosts, rules and native components. Installation warnings depend on permission combinations; their number is not a security score.

4. Test restriction and removal

   In managed Edge, a blocked permission can disable an extension without removing it. Check policy scope and separately remove native components and external data where required. Retain evidence of the final state.

Google Chrome · Permission warning guidelines · Documentation consulted 2026-10-23; browser behaviour remains version-dependent

Google Chrome · Stay secure · Documentation consulted 2026-10-23; browser behaviour remains version-dependent

Microsoft Learn · Manage Microsoft Edge extensions using group policies · Enterprise policy documentation consulted 2026-10-23

Technical references: Google Chrome for Developers and Microsoft Learn, linked below and at each permission. Google documentation is CC BY 4.0 except where noted; descriptions and questions above are CIE editorial synthesis adapted into French and English. Fictional examples are original. This page is not a Google or Microsoft validation.

Google Developers · Site policies · Documentation attribution and reuse conditions

Creative Commons Attribution 4.0