The fix, in one snippet
"optional_permissions": ["history", "downloads"]Illustrative values. Change the paths, hostnames and options to match your own site before using it.
The sections below explain what is tested, why it matters and the alternatives.
What we test
The analyser reads optional_permissions and optional_host_permissions (Manifest V3) or match patterns within optional_permissions (Manifest V2) and lists each with what it would grant if you approve it, cross-referencing the high-impact ones (<all_urls>, cookies, history, downloads) with the dangerous-permissions check. It also notes a permission that appears in both the required and optional lists (redundant) and whether the code ever calls permissions.request(); if it never does, the declaration is dead. Limits: the analyser cannot know when the extension will ask, and once granted an optional permission is equivalent to a required one until you revoke it.
Why it matters
Optional permissions are the least-privilege mechanism for extensions: the package installs with a small footprint and asks in context ("Allow on this site?") when a feature needs more. The risk is human: prompts get approved reflexively, and a later update can add new optional permissions without the install-time warning that new required permissions trigger (those disable the extension until you accept). Over months an extension can accumulate broad access one click at a time. Because nothing is granted until you agree, the severity is informational.
How to fix it
Users: treat each runtime prompt as an install decision. Review what has been granted so far: Chrome and Edge, chrome://extensions > Details > Site access and Permissions; Firefox, about:addons > the extension > Permissions, where optional grants have toggles you can switch off; Safari, Settings > Extensions.
Developers: keep the required set minimal, request from a user gesture, handle refusal gracefully and release permissions you stop using:
"optional_permissions": ["bookmarks"],
"optional_host_permissions": ["https://*.example.com/*"]
button.onclick = async () => {
const ok = await chrome.permissions.request({permissions: ["bookmarks"]});
if (!ok) showFallback();
};Related: broad host permissions. Guide: are browser extensions safe?
Where this fits
Extension declares optional permissions is check 9 of 9 that the browser extension analyzer runs under extension permissions and behaviour, ordered the way they are worth fixing. That ordering is the point: Fixing this one while the check above it still fails buys less than it looks like.
Fix this one first
Above it in the same category sits Extension uses Manifest V2 (low), where the extension still declares manifest_version 2, a format Chrome no longer runs and that lacks the stricter code and policy rules of Manifest V3. An attacker who has that does not need this, so it is the better use of the same hour.
The first few lines
You are a senior web engineer. I ran a security and SEO scanner against my site and it reported the finding below. Fix it properly rather than suppressing the symptom.
Finding: Extension declares optional permissions (info severity)
Scanner check id: extension-optional-permissionsThe rest of this prompt names the pages and line numbers we found the problem on, the configuration to change, and the constraints a good answer has to respect. It is free, it just needs an account so the work is not scraped wholesale.
Sign in with GoogleSigning in is free and takes one click. We store your email address and nothing else.
