How to Check Firefox Add-on Permissions Before Installing

This article explains how to review the security permissions requested by a Mozilla Firefox add-on before you install it. You will learn how to find permission details directly on the Firefox Add-ons store page, how to read the pre-installation pop-up prompt, and how advanced users can inspect the extension's source code to verify its access requirements before adding it to the browser.

Method 1: Check the Firefox Add-ons Store Page

You can view the required permissions for most extensions directly on their store listing before initiating any download.

  1. Open the Firefox browser and navigate to the official Mozilla Add-ons store.
  2. Search for and select the add-on you wish to examine.
  3. Scroll down the page and look at the column on the left side labeled More information.
  4. Locate the Permissions section within this column.
  5. Review the bulleted list of permissions the add-on requires to function. If the section is not present, the add-on does not require any special permissions that compromise your data.

Method 2: Review the Installation Prompt

Firefox forces a mandatory security check the moment you decide to install an extension, allowing you to abort the process if the permissions seem excessive.

  1. On the add-on's store page, click the blue Add to Firefox button.
  2. Do not immediately click confirm. Instead, look at the pop-up dialog box that appears near the top of your browser window.
  3. Under the heading It requires your permission to:, read the exact system and data access the extension is requesting.
  4. Click the Learn more link at the bottom of the pop-up if you need definitions for the listed permissions.
  5. Click Cancel if you do not want to grant these permissions, or click Add if you trust the extension.

Method 3: Inspect the Manifest File (Advanced)

For absolute certainty, you can download the add-on package and read its configuration file without installing it into Firefox.

  1. Go to the add-on's page in the Mozilla Add-ons store.
  2. Right-click the Add to Firefox button and select Save Link As... from the context menu.
  3. Save the file to your computer. It will download with an .xpi file extension.
  4. Rename the file extension from .xpi to .zip, or open the .xpi file directly using a file archiver program like 7-Zip or WinRAR.
  5. Extract the contents of the archive and locate the file named manifest.json.
  6. Open manifest.json using any standard text editor, such as Notepad or TextEdit.
  7. Search the text for the "permissions" and "optional_permissions" sections. The strings listed in brackets next to these headers represent the exact API and data access the add-on is programmed to use.

Understanding Common High-Risk Permissions

When examining permissions, pay close attention to the following requests, as they grant the add-on significant access to your browser:

  • Access your data for all websites: The add-on can read and modify everything you type, view, or click on every webpage you visit.
  • Access browser tabs: The add-on can see the URLs and titles of your open tabs, as well as open, close, or rearrange them.
  • Access your data for sites in the [named] domain: Similar to the all-websites permission, but restricted only to the specific website mentioned.
  • Exchange messages with programs other than Firefox: The add-on can communicate with software installed directly on your computer's operating system.
  • Input data to the clipboard / Get data from the clipboard: The add-on can read whatever you have copied or overwrite your clipboard with new data.