| debugger | Permission | | This permission grants the extension ability to debug and control other extensions and browser tabs. Rated Critical because it can access and modify other extensions' internal state, inject code, and access sensitive data from any tab. |
| privacy | Permission | | This permission allows modification of Chrome's privacy settings. Rated Critical because it can disable security features, modify network configurations, and compromise browser security settings. |
| proxy | Permission | | This permission allows the extension to control the browser's proxy settings. Rated Critical because it can route all traffic through potentially malicious proxies, enabling man-in-the-middle attacks and traffic monitoring. |
| scripting | Permission | | This permission allows injection and execution of JavaScript on any webpage. Rated Critical because it can modify page content, steal sensitive data, and inject malicious code into any site the extension has access to. |
| webRequest | Permission | | This permission enables the extension to monitor and analyze all web requests made by the browser. Rated Critical because it can observe all network traffic including sensitive data, track browsing behavior, and gather authentication tokens. |
| <all_urls> | Host | | Broad host access — the extension can read/modify content on every website. |
| Dangerous Permission Combination: scripting,<all_urls>,webRequest | Risk Factor | | Enables sophisticated data theft through script injection and traffic monitoring |
| Dangerous Permission Combination: scripting,<all_urls>,cookies | Risk Factor | | Enables sophisticated data theft through script injection and traffic monitoring |
| Dangerous Permission Combination: contentSettings,privacy,management | Risk Factor | | Allows extensions to modify content settings, manage web requests, and potentially alter web content and proxy settings, giving them substantial influence over browser behavior. |
| Dangerous Permission Combination: cookies,webRequest,identity | Risk Factor | | Allows extensions to intercept web requests, manage cookies, and access identity or certificate-related functionalities, potentially compromising secure access and authentication processes. |
| browsingData | Permission | | This permission clears browsing data, history, and redis. Rated High because it can destroy evidence of malicious activity, clear security logs, and modify browser state. |
| clipboardRead | Permission | | This permission allows reading clipboard content. Rated High because it can steal copied passwords, sensitive data, and monitor all content copied to clipboard. |
| clipboardWrite | Permission | | This permission allows modification of clipboard content. Rated High because it can inject malicious content into the clipboard, modify copied passwords, and manipulate copied data. |
| contentSettings | Permission | | This permission allows modification of website-specific content settings. Rated High because it can disable security features like JavaScript restrictions, mixed content blocking, and cookie controls for specific sites. |
| cookies | Permission | | This permission provides full access to read and modify browser cookies. Rated High because it can steal session tokens, modify authentication cookies, and compromise accounts across websites. |
| desktopCapture | Permission | | This permission captures content from your desktop screens. Rated High because it can record sensitive information from any window, capture passwords, and monitor user activity. |
| downloads | Permission | | This permission controls file downloads and accesses download history. Rated High because it can download malicious files, access sensitive downloaded documents, and track user download patterns. |
| geolocation | Permission | | This permission accesses precise device location. Rated High because it can track user movements, identify physical locations, and compromise user privacy. |
| history | Permission | | This permission grants access to your complete browsing history. Rated High because it can track all visited websites, reveal sensitive browsing patterns, and expose private information. |
| identity | Permission | | This permission accesses Chrome identity service and user information. Rated High because it can obtain OAuth tokens, access connected accounts, and impersonate the user in authenticated service. |
| nativeMessaging | Permission | | This permission enables communication with applications installed on your computer. Rated High because it can exchange data with native programs, potentially exposing system-level information and local files. |
| sessions | Permission | | This permission accesses recently closed tabs and windows. Rated High because it can monitor user activity, recover closed sensitive pages, and track browsing patterns. |
| tabCapture | Permission | | This permission captures content and audio from browser tabs. Rated High because it can record sensitive web content, capture form input, and monitor user interactions. |
| topSites | Permission | | This permission accesses the list of most visited websites. Rated High because it can reveal browsing patterns, identify frequently accessed service, and gather user behavior data. |
| webNavigation | Permission | | This permission enables monitoring of all browser navigation events and transitions. Rated High because it can track every page visit, navigation method, and browsing pattern, potentially exposing sensitive browsing behavior and user activities. |
| Dangerous Permission Combination: history,tabs,webNavigation,topSites | Risk Factor | | Enables extensive monitoring and access to sensitive aspects of your digital activities. |
| Dangerous Permission Combination: desktopCapture,downloads,storage | Risk Factor | | Enables extensive monitoring and access to sensitive aspects of your digital activities. |
| Dangerous Permission Combination: management,background,sessions | Risk Factor | | Enables extensions to maintain long-term presence, manage data extensively, and potentially access sensitive browsing sessions and cookies. |
| Dangerous Permission Combination: webRequest,cookies,sessions | Risk Factor | | Enables extensions to maintain long-term presence, manage data extensively, and potentially access sensitive browsing sessions and cookies. |
| Dangerous Permission Combination: cookies,history,bookmarks | Risk Factor | | Allows access to location data, personal identifiers, and sensitive browsing information, potentially exposing personal and confidential user data. |
| Dangerous Permission Combination: clipboardRead,tabCapture,downloads | Risk Factor | | Allows access to location data, personal identifiers, and sensitive browsing information, potentially exposing personal and confidential user data. |
| Dangerous Permission Combination: scripting,cookies,webRequest | Risk Factor | | Enables extensions to interact with scripts, modify files and downloads, and alter browsing history and bookmarks, potentially affecting data integrity and user control. |
| Dangerous Permission Combination: browsingData,history,bookmarks | Risk Factor | | Enables extensions to interact with scripts, modify files and downloads, and alter browsing history and bookmarks, potentially affecting data integrity and user control. |
| Dangerous Permission Combination: background,webRequest,storage | Risk Factor | | Enables extensions to operate in the background, intercept web requests, and manage privacy settings and browsing data, facilitating concealed actions and potentially undetected modifications. |
| Dangerous Permission Combination: management,privacy,browsingData | Risk Factor | | Enables extensions to operate in the background, intercept web requests, and manage privacy settings and browsing data, facilitating concealed actions and potentially undetected modifications. |
| Contextual Risk Factors | Risk Factor | | The following context increases the overall risk:• 10% increase: About:blank access enables potential sandbox escape vectors |
| Broad Host Permissions | Risk Factor | | This extension has broad host permissions allowing it to access many or all websites. |
| Broad Content Script Access | Risk Factor | | This extension can inject scripts into any website. |
| activeTab | Permission | | This permission grants temporary access to the current tab. Rated Medium because it can access current page content when invoked, though limited to user-initiated actions. |
| background | Permission | | This permission allows continuous background operation. Rated Medium because it can perform actions without user awareness, consume system resources, and maintain persistent connections. |
| declarativeContent | Permission | | This permission controls extension activation based on page content. Rated Medium because it can monitor page content matches and selectively activate extension features. |
| gcm | Permission | | This permission enables Google Cloud Messaging for push notifications. Rated Medium because it can maintain persistent connections, receive external messages, and operate in the background. |
| management | Permission | | This permission manages other installed extensions. Rated Medium because it can enable/disable other extensions and modify their settings, with changes being visible to users. |
| pageCapture | Permission | | This permission enables saving complete web pages as MHTML. Rated Medium because it can archive sensitive web content, capture full page data, and store browsing history artifacts. |
| power | Permission | | This permission controls system power management features. Rated Medium because it can prevent the system from sleeping, potentially draining battery or maintaining unwanted connections. |
| storage | Permission | | This permission allows storing data locally in the browser. Rated Medium because it can persist sensitive user data, track user activities over time, and potentially store malicious payloads. |
| system.cpu | Permission | | This permission provides access to CPU usage and information. Rated Medium because it can monitor system performance, detect other applications, and potentially identify user activities. |
| system.memory | Permission | | This permission accesses system memory information. Rated Medium because it can monitor memory usage patterns, detect other applications, and gather system state information. |
| system.storage | Permission | | This permission provides access to storage device information. Rated Medium because it can monitor storage usage, detect installed applications, and gather system configuration data. |
| tabGroups | Permission | | This permission manages tab grouping functionality. Rated Medium because it can monitor tab organization, track user workflow patterns, and modify tab relationships. |
| tabs | Permission | | This permission enables tab management and monitoring. Rated Medium because it can track open tabs, access tab metadata, and monitor user browsing patterns. |
| About:blank Access | Risk Factor | | This extension can run content scripts in about:blank pages. |
| alarms | Permission | | This permission schedules periodic tasks. Rated Low because it can only trigger events at specified times without access to sensitive data. |
| bookmarks | Permission | | This permission manages browser bookmarks and folders. Rated Low because it can only modify bookmark data, which is not sensitive and changes are visible to users. |
| contextMenus | Permission | | This permission adds items to browser context menus. Rated Medium because it only modifies right-click menus without access to page content. |
| fontSettings | Permission | | This permission controls browser font rendering settings. Rated Low because it only affects visual display preferences without access to content. |
| idle | Permission | | This permission detects system idle state. Rated Low because it only observes user activity state without access to activity details. |
| notifications | Permission | | This permission displays system notifications. Rated Low because it can only show user-visible notifications without accessing system data. |
| search | Permission | | This permission accesses search functionality. Rated Low because it only interacts with the browser's search feature without accessing search history. |
| system.display | Permission | | This permission reads display configuration. Rated Low because it only accesses screen properties without content access. |
| tts | Permission | | This permission enables text-to-speech functionality. Rated Low because it can only convert visible text to speech without accessing sensitive data. |
| ttsEngine | Permission | | This permission implements a text-to-speech engine. Rated Low because it only processes text for speech conversion without storing or transmitting data. |
Edge Add-ons
