How to Review Local Extension Permissions

Do not review only the name and version when importing a local extension. The MaskPilot confirmation screen also shows the profiles that will use the extension, its website access, browser capabilities, and minimum browser version. Each item answers a different question and should be reviewed separately.

Separate the four types of information

Confirmation item	What it means	What to check
Application scope	Which MaskPilot profiles select the extension	For an initial test, prefer matching tags or leave it disabled by default instead of expanding the scope unconditionally
Website access	The sites the extension declares it may interact with	Whether each domain is necessary and whether the list includes an unnecessarily broad range
Browser capabilities	The browser features the extension declares	Whether the extension’s core purpose explains every capability
Required browser	The minimum browser version declared in the Manifest	Whether the target profiles use a compatible browser version

Application scope is a MaskPilot profile assignment setting, not a website permission. Selecting fewer profiles does not narrow the extension’s declared website access inside an individual profile. The minimum browser version is a compatibility requirement, not a measure of how powerful the permissions are.

Review website access

The website access list summarizes site ranges declared in the extension Manifest, including host permissions, optional host permissions, and content-script match patterns. A matching content script may run extension code in pages on that site. Host permissions can also support access to page addresses, cookies, or network requests, depending on the other APIs used by the extension.

Review the list in this order:

1. Write down the websites where the extension must work.
2. Match every domain on the confirmation screen to that purpose.
3. For a broad declaration that covers many websites, require a clear reason why the extension cannot request only the necessary domains.
4. Stop the import and verify any unexplained domain, temporary test domain, or range unrelated to the extension’s purpose.

MaskPilot combines required and optional website declarations in this preview. An item appearing here means that the package declares the range; it does not mean that the range has already been granted on the current page or is actively being used.

Review browser capabilities

The browser capabilities list summarizes required and optional Manifest permissions. Do not judge safety from a permission name alone, and do not assume that a short list is automatically trustworthy. Map each capability to the extension’s core behavior, such as saving its own settings, reading information about the active tab, or performing a task after a user action.

Cancel the import when the extension description, developer documentation, and reproducible behavior cannot explain a capability. Do not delete permissions from the Manifest merely to pass the review. That may break the extension and removes traceability to the original package.

Focus on newly added access when replacing a package

When replacing an existing local extension, MaskPilot shows the complete website access and browser capabilities again and identifies access newly added relative to the current copy. It also calls out an increased minimum browser requirement. Existing profile selections are preserved, but that does not automatically approve the behavior of the new version.

When new access appears:

1. Confirm that the version and source match the developer’s release information.
2. Map every new access item to a documented new feature.
3. Test first in a disposable profile that contains no production credentials.
4. Expand the profile scope only after page behavior and network access match expectations.

If the browser disables an extension after an update, use the extension compatibility and permission-change checklist instead of repeatedly enabling it without review.

A permission preview is not a code security audit

The preview explains what the package declares. It does not audit source code, remote services, data handling, or actual network requests. “No additional capabilities declared” is not proof that an extension is safe. Cancel the import when the source is unknown, the purpose is unclear, or a permission cannot be explained.

See import and manage a local browser extension for the normal import and profile-assignment flow. If the import fails before the confirmation screen, use fix local extension Manifest import errors to check the package structure.

Chrome’s official documentation explains where extension permissions are declared and what they enable, permission warnings and update behavior, and the compatibility meaning of a minimum browser version.