Skip to content

What each other Chrome permission would have allowed instead of storage

Last checked

Storage lets an extension remember small settings and nothing else. Placed next to history, tabs, scripting and webRequest, each of which would have granted far broader access, storage sits at the narrow end of what a Chrome extension can request, which is exactly what Docognito asks for.

Why comparing permissions is more useful than describing one

Knowing what storage does in isolation only goes so far. What actually tells a cautious reader something useful is a comparison: placed next to the other permissions a Chrome extension could have requested instead, how much access does storage actually represent. Each permission below is a real, named entry Chrome extensions can request, and each one would have let an extension reach somewhere storage cannot.

What the history permission would have allowed

The history permission grants read access to a browser's entire visited page record: every address, every page title, and when each visit happened, going back as far as the browser retains it. An extension holding this permission could search that record, correlate it, or send it somewhere else entirely. Storage grants none of that. It cannot read a single entry from your browsing history, because history and storage are separate, independently declared permissions, and requesting one does not grant the other.

What the tabs permission would have allowed

The tabs permission lets an extension see the title and address of every open tab across every window, not only the tab the extension happens to be active on. Combined with enough other access, it can also let an extension move, close or create tabs programmatically. A storage only extension has no visibility into tabs at all. It cannot tell how many tabs are open, what any of them are titled, or which sites they point to, because none of that is what the permission was built to expose.

What scripting and broad host permissions would have allowed

Scripting is the permission that lets an extension inject and run JavaScript into a page at a moment it chooses, rather than only through code declared once in advance. Paired with a host permission covering every website, that combination lets an extension read or alter the content of any page you load, on any site, at any time. A host permission does not have to be that broad. It can instead be scoped to a short, named list of sites, which limits an extension's reach to exactly those addresses and nowhere else. Storage carries no host access whatsoever on its own, broad or narrow, because it is not a permission about pages at all.

What the webRequest permission would have allowed

The webRequest permission lets an extension observe every network request a browser tab makes, headers included, before a page has even finished loading. In its blocking form it can also redirect or cancel a request outright. That is a permission built for the network layer, watching traffic as it moves rather than reading whatever a page eventually renders. Storage sits nowhere near that layer. It has no access to a network request of any kind, incoming or outgoing.

Where storage actually sits on that spectrum

PermissionWhat it would grantWhat storage grants instead
historyEvery visited page, address, title and timeNothing. Storage cannot read a browsing history entry
tabsTitles and addresses of every open tabNothing. Storage has no visibility into open tabs
scripting plus a broad host permissionReading or altering any page, on any siteNothing. No host access is bundled with storage
webRequestEvery network request a tab makes, headers includedNothing. Storage has no access to network traffic
storageRemembering an extension's own small settingsThis is the entire grant, and it stops here

Read top to bottom, each row grants strictly more than the one below it. Storage sits at the very bottom, which is the honest way to describe how narrow the request actually is rather than simply asserting it.

Check any extension's list against this table, not just Docognito's

The same five rows apply to any Chrome extension you are considering. A listing that requests history, tabs, scripting with a broad host permission, or webRequest is asking for meaningfully more than one that requests storage alone, regardless of what either one claims to do.

How this applies to Docognito specifically

one browser permission, storage. Its manifest requests none of the five rows above except the last one, and claude.ai, chatgpt.com and chat.openai.com, and no other website is the narrowest form a host permission can take, three named addresses rather than every website a browser can open. Redrawing the visible page, redrawn as a document editor, the the browser tab title and the the tab icon does not require reading history, watching open tabs, injecting code beyond those three named sites, or observing network requests, so none of those permissions appear in the manifest at all. Whether an extension can see what is typed on a page is a separate question from any permission in the table above, and it is answered directly in what a Chrome extension can see when you type.

Why storage alone is the narrow end of the permission list

Do not judge a permission by how broad its name sounds on its own. Judge it against what the other named permissions would have granted instead. History, tabs, scripting paired with a broad host permission, and webRequest each reach somewhere storage cannot reach at all, and a request for storage alone, with none of those four alongside it, is about as narrow as a Chrome extension's permission list gets.

Common questions

What would the history permission have let this extension do that storage does not?

History would grant access to every page you have visited across the browser, titles, addresses and visit times included. Storage grants none of that. It only remembers two small settings the extension itself created.

What would the tabs permission have added on top of storage?

Tabs would let an extension see the titles and addresses of every open tab across every window, not just the one it is running on. Storage cannot see any tab at all, open or closed.

Is a narrow permission list actually rare among Chrome extensions?

It is on the narrow end. Many extensions request several permissions at once to cover broader functionality, so a single request scoped to storage alone sits well below the typical footprint.

Can a browser extension see what I type even without any of these permissions?

That depends on a different permission entirely, the one granting a content script access to the page itself. It is covered in full in the linked article below rather than repeated here.

Hide AI on your screenFree Chrome extension

Add to Chrome