The fix, in one snippet
chrome://extensions > Details > PermissionsIllustrative values. Change the paths, hostnames and options to match your own site before using it.
The sections below explain what is tested, why it matters and the alternatives.
What we test
The analyser reads permissions and optional_permissions and weighs each against a list: webRequest with webRequestBlocking, declarativeNetRequest combined with broad hosts, cookies, history, tabs, webNavigation, downloads, nativeMessaging, debugger, proxy, management, clipboardRead, privacy, contentSettings, pageCapture, desktopCapture, browsingData, sessions, geolocation and identity. Each is explained in the report, and severity comes from the combination: debugger, nativeMessaging or proxy alone is high; tabs plus history is medium. Limits: legitimate tools need some of these (a password manager needs tabs, an ad blocker needs request APIs, a download manager needs downloads). The question the report cannot answer is whether the stated purpose justifies the list.
Why it matters
Each permission is a concrete capability. cookies reads session cookies for any permitted host without touching a page, which is account takeover. debugger attaches the DevTools protocol to any tab and can drive it. proxy routes all traffic through a server of the extension's choosing. nativeMessaging talks to a program outside the browser sandbox. tabs plus history is your complete browsing record; the 2019 DataSpii investigation showed extensions collecting exactly that and selling it through an analytics service, complete with URLs containing private tokens. Every user of the extension is affected, on every site it can reach.
How to fix it
Users: read the permission warnings at install and compare them with what the extension is for. On Chrome and Edge, chrome://extensions > Details lists the granted permissions; the store listing's Privacy practices tab states what data is collected. If the list is out of proportion, remove the extension or find one with a smaller footprint. Keep the total number of extensions small.
Developers: practise least privilege. Move rarely used capabilities to optional_permissions and request them at the moment of use; avoid debugger and nativeMessaging unless they are the product. Related checks: broad host permissions and optional permissions. Guides: are browser extensions safe? and how ad blockers work.
Where this fits
Extension requests high-risk permissions is check 4 of 9 that the browser extension analyzer runs under extension permissions and behaviour, ordered the way they are worth fixing. That ordering is the point: Fixing this one while the check above it still fails buys less than it looks like.
Fix this one first
Above it in the same category sits Extension code is obfuscated (high), where the extension's JavaScript is obfuscated rather than merely minified, which hides its behaviour from reviewers and breaks the Chrome Web Store's code-readability rule. An attacker who has that does not need this, so it is the better use of the same hour.
What fixing this still leaves open
Extension requests high-risk permissions closes one route in. Immediately below it: Content scripts injected into every page, where the extension injects its own script into every page you open, whether or not you use it there; Extension contacts external endpoints, where the extension's code contains addresses of external servers it communicates with, so some of your data or activity may leave the browser; Extension weakens its Content-Security-Policy, where the extension's content_security_policy loosens the default protections, permitting inline scripts, eval or remote scripts inside the extension's own pages.
The first few lines
You are a senior web engineer. I ran a security and SEO scanner against my site and it reported the finding below. Fix it properly rather than suppressing the symptom.
Finding: Extension requests high-risk permissions (high severity)
Scanner check id: extension-dangerous-permissionsThe rest of this prompt names the pages and line numbers we found the problem on, the configuration to change, and the constraints a good answer has to respect. It is free, it just needs an account so the work is not scraped wholesale.
Sign in with GoogleSigning in is free and takes one click. We store your email address and nothing else.
References
Related guides
7 min read · Updated Sep 10, 2026
Are Browser Extensions Safe? How to Audit What You Have Installed
Extensions run with more access than any website, and a sold or hijacked extension can read everything you do. What each permission...
Read the guide
8 min read · Updated Sep 04, 2026
How Ad Blockers and Tracker Blockers Work (and Why Manifest V3 Changed Them)
A content blocker matches every request against filter lists and stops the ones that serve ads or trackers. Filter lists, cosmetic...
Read the guide