Does Google Chrome not require host permissions?

[ComputerWhiz]

I'm porting my extension from Firefox. I'm using a content script in the manifest that runs a JavaScript file. That JavaScript file sends a message to the background script and the background script sends a reply. The reply from the background script is a string of CSS, which the content script JavaScript file inserts into the loaded page.

Because my content script matches "<all_urls>", it requires a broad host permission on Firefox. But it looks like I can do this on Google Chrome without any permissions at all.

Am I correct in my assumption or is it only working for me because I'm running Chrome in developer mode? To be honest, it seems a little strange that I can view and modify any page with my extension and not explicitly ask for permission.

[Simeon Vincent]

It might be helpful to take a step back and ask how are you injecting the content script? If you're declaring content scripts in your manifest and using match patterns, you're already implicitly requesting a specialized type of host permission. That's why an extension with no "permissions" but that still injects content scripts on "<all_urls>" will still see a "broad host permissions" warning when submitting to the Chrome Web Store.

Simeon - @dotproto
Chrome Extensions DevRel

[ComputerWhiz]

Ok, thanks for the information.

I'm declaring them in the manifest file, so then I guess I don't need to explicitly declare the permission in the permissions manifest key then. That works a little differently to Firefox, unless Firefox has also changed at some point.

[wOxxOm]

Neither Chrome nor Firefox need `permissions` to be able to send a message to the content script.