EG-PERM-004: Broad host access requires review

What ExtensionGate detects

The rule normalizes host_permissions, optional_host_permissions, and content-script matches, then identifies patterns such as <all_urls>, http://*/*, and https://*/*.

It records where access is declared and distinguishes required from optional declarations. It does not claim that broad access is automatically prohibited.

Why it may matter

Broad origin access can expose browsing data and create strong user warnings. Chrome asks developers to request the narrowest permissions needed; Microsoft requires requested capabilities to be essential and accurately disclosed.

A reviewer needs product context that a ZIP cannot supply: which feature uses the access, when it is activated, and why narrower or optional access is insufficient.

Synthetic failing example

{
  "host_permissions": ["<all_urls>"],
  "content_scripts": [{ "matches": ["http://*/*", "https://*/*"] }]
}

This synthetic manifest grants persistent access across a very large origin set without showing why it is required.

Passing or legitimate example

{
  "permissions": ["activeTab", "scripting"],
  "optional_host_permissions": ["https://*.example.test/*"]
}

This synthetic alternative uses a user gesture and defers one scoped host family. It is only appropriate if the feature truly works within those boundaries.

Remediation

1. Map every host pattern to a named, user-visible feature and data use.
2. Replace broad patterns with supported origins, activeTab, or optional host permissions where those designs meet the product requirement.
3. Handle denied and revoked access without breaking unrelated features.
4. Align install copy, listing, privacy answers, and reviewer notes with the final scope.

False-positive boundaries

• Security, accessibility, developer tooling, and user-directed blockers may legitimately need broad access.
• Optional broad access still needs review but has a different consent boundary from required install-time access.
• The rule does not downgrade a necessary permission merely because it covers many sites.

What static analysis cannot determine

• The primary product purpose and actual feature necessity are not inferable from manifest syntax alone.
• Runtime permission requests, enterprise policy, and server-side feature flags may change effective access.
• Static analysis cannot prove what browsing data is transmitted or retained.

Official sources

• Chrome: declare permissions
• Chrome tabs API permission guidance
• Microsoft Edge extension developer policies

Rule version history

Related guides

• Permission justification guide
• Privacy disclosure checklist