You're installing a Chrome extension, you click Add, and Chrome throws up a warning that sounds like it belongs in a heist movie: "This extension can read and change all your data on all websites you visit." There's zero context around it, so of course your thumb hovers over the button for a second.
Fair reaction. Let's actually unpack what it means, because the honest answer is "it depends entirely on the extension," and Chrome's wording doesn't help you tell the difference.
What triggers this specific warning
It's not some special surveillance permission. It's the host_permissions field in an extension's manifest, specifically when it's set to run on http://*/* and https://*/*, meaning literally any site, rather than a short list of specific domains. Chrome shows the scariest possible phrasing for this because, technically, an extension with this permission could read anything on any page you're looking at. The bank site. Your email. This article.
There's a quieter alternative most extensions could use instead: activeTab. It grants access to only the current tab, only after you click the extension's icon or use a keyboard shortcut, and it never shows this scary warning at all, because Chrome trusts that an explicit click means you meant it. If you ever wonder why some extensions ask for "all sites" and others don't, this is usually the reason: the quiet ones only need to act when you tell them to.
It's also worth knowing the warning can hide information rather than add it. If an extension already has the broad <all_urls> permission, Chrome won't bother showing you a separate warning for narrower permissions like tabs, since the broad one already covers it. So the one scary line you see isn't always the full list, it's Chrome collapsing several permissions into the worst-case summary.
Why a cookie or tracker blocker can't just use activeTab
This is the honest answer for tools like ours: banners and trackers show up the moment a page loads, before you've clicked anything. activeTab only activates after a click, which is fine for a screenshot tool or a "clean up this page" button, but useless for something that has to act before you'd ever think to click it. An extension that reacts automatically to what a page does has to already be watching, there's no way around that.
When it's actually reasonable
Some categories of extension can't function without it, because the thing they block or fix doesn't live on a fixed list of websites. A cookie banner blocker needs this because banners appear on any site. A tracker blocker needs this because trackers hide in scripts on any site. A password manager needs this to autofill login forms on any site. In all three cases, "every site" isn't overreach, it's the actual shape of the problem.
When it's a real red flag
The mismatch is the tell, not the permission itself. A currency converter doesn't need to see every page you load. A single-site helper tool for one specific service doesn't need it either. If an extension's stated purpose is narrow but its permissions are maximal, that gap is worth asking about, and it's one of the most reliable signs something is off, regardless of how polished the listing looks.
How to actually check, instead of just trusting the warning
- Click "Details" on the extension's Chrome Web Store listing and read what it says it does, in plain terms, not marketing copy.
- Check if it's open source. You don't have to read the code yourself, but "you can" changes the incentive for what gets shipped.
- Look at what data the listing itself discloses it collects. A privacy tool that discloses collecting "personal communications" and "web history" is contradicting its own pitch, that's worth noticing.
- If the developer publishes what each permission is for and why, read it. If they don't, that's not proof of anything bad, but it's a missed chance to earn trust cheaply.
We went through exactly this exercise for GetPawsOff after a reader pointed out the mismatch between our own "nothing leaves your device" pitch and how scary our install prompt looked next to it. Fair catch. We didn't ask for fewer permissions, we still need every one of them, we just wrote down plainly why each one is there. You can't make the warning less scary. You can make sure it's telling the truth.