Chromium's On-Click Extension Permissions Model Explained
This article explores the permissions model used by the Chromium web
browser to grant extensions temporary host access exclusively when a
user clicks the extension icon. It covers the technical foundation of
this model—specifically the activeTab permission and the
user-facing Runtime Host Permissions system—and explains how these
mechanisms work together to protect user privacy and security while
maintaining extension functionality.
To let users grant host access to extensions only upon clicking the
extension icon, Chromium uses a combination of two mechanisms: the
activeTab permission (implemented by
developers) and Runtime Host Permissions (controlled by
users).
1. The activeTab
Permission Model
At the core of Chromium's on-click access is the
activeTab permission. Developers declare this permission in
the extension's manifest.json file instead of requesting
broad, permanent access to specific websites or all URLs.
When an extension uses the activeTab model, it has zero
access to the user's browsing data by default. Host access is granted
only when the user explicitly invokes the extension, most commonly by
clicking its icon in the browser toolbar.
Once clicked, the activeTab permission grants the
extension temporary capability to:
- Execute scripts or inject CSS into the currently active tab.
- Read the URL, title, and favicon of the active tab via the Tabs API.
- Intercept network requests on the active tab's main frame origin.
This access lasts only as long as the user stays on that specific page. The moment the user navigates to a different URL (origin) within that tab or closes the tab entirely, Chromium automatically revokes the extension's host access.
2. Runtime Host Permissions (User-Controlled "On Click" Access)
Not all developers use the activeTab permission; many
still build extensions that request continuous, broad access to all
websites (using the <all_urls> or
*://*/* match patterns). To give users control over these
invasive extensions, Chromium uses the Runtime Host
Permissions model.
Runtime Host Permissions allow users to override an extension's
requested permissions and force it to behave as if it uses the
activeTab model. Users can configure an extension's site
access to one of three states:
- On click: The extension is denied all background host access. It can only read and change data on the current site when the user clicks the extension icon.
- On specific sites: The extension is granted continuous access only to a user-defined list of URLs.
- On all sites: The default state for extensions requesting broad permissions, allowing continuous access everywhere.
When a user selects the "On click" setting, Chromium withholds the
host permissions the extension originally requested at installation.
When the user clicks the extension icon, Chromium dynamically injects
the required host permission for the active tab at runtime. Just like
activeTab, this access is temporary and is revoked once the
tab is closed or navigated to a new domain.
Summary of Security Benefits
By utilizing the activeTab and Runtime Host Permissions
models, Chromium applies the principle of least privilege. It prevents
extensions from silently harvesting browsing history or injecting
unwanted code in the background. Users remain entirely in control,
granting extensions access to sensitive webpage data strictly on a
need-to-know, on-demand basis.