{
  "id": 13451878,
  "title": "I shipped Chrome extensions with an empty permissions list. Here is what that costs you.",
  "url": "https://urgent.news/2026/10/10/i-shipped-chrome-extensions-with-an-empty-permissions-list-here-is",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-10-10T15:48:43.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/_4143d12ca219f32cb635/i-shipped-chrome-extensions-with-an-empty-permissions-list-here-is-what-that-costs-you-5a94"
  },
  "original_language": "en",
  "account": "Building small developer tools as Chrome extensions allowed me to explore the impact of empty permissions. All five extensions were shipped with an empty permissions array, meaning no access to the current page, storage, or clipboard. Three main capabilities were sacrificed: the ability to read the selected text or URL, preserving state between sessions, and clipboard functionality. Despite these limitations, the extensions primarily relied on normal web page functionalities such as Web Crypto, TextEncoder, and DOM APIs. No external requests or network operations were made. No code from npm was bundled, and all tools were hand-written. This approach led to a few hundred lines of custom code for each extension, resulting in each zip file being around 16 KB. The source code that reviewers see is the same that ships, meaning there's no hidden transitive dependency tree. The tradeoff was worth it for these simple tools, but for more complex applications, a dependency would be preferable to avoid potential bugs and maintain review efficiency.",
  "summary": "Every Chrome extension I install asks for something. Read and change all your data on all websites, usually. So when I built five small developer utilities as extensions, I wanted to know how far I could get with the permissions array empty. All five shipped with this: { \"manifest_version\" : 3 , \"name\" : \"Base64 Encoder & Decoder\" , \"version\" : \"1.0.0\" , \"description\" : \"...\" , \"icons\" : { \"16\" :…",
  "key_points": [
    "Five Chrome extensions shipped with empty permissions array",
    "Extensions relied on normal web page functionalities",
    "No external requests or network operations made"
  ],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}