EXT-002 Overbroad extension permissions

A browser extension's manifest grants more reach than it needs: every URL (<all_urls>), high-impact APIs such as debugger or webRequestBlocking, or several broad permissions together. If the publisher is ever compromised, that reach becomes a session-token incident for every site the user is signed into.

What Vulkro detects

Trigger	Severity	Weight
`<all_urls>` or its equivalents (`:///`, `http:///`, `https:///*`) in `host_permissions` or `permissions`	`High`	`0.9`
`debugger` or `webRequestBlocking` permission	`High`	`0.9`
Two or more of `tabs`, `history`, `cookies`, `downloads`, `webNavigation`, `webRequest`, `<all_urls>` together	`Medium`	`0.6`

Confidence is always High (a literal manifest read). Evidence signal: extension-overbroad-permissions, source Pattern. The finding message names the most severe driver.

VS Code-family extensions are skipped because their on-disk extensions.json carries no per-extension permissions. The rule reads Chromium per-extension manifest.json files and Firefox addon records.

Non-compliant code

debugger alone fires (High), <all_urls> alone fires (High), and tabs + cookies + history fires (Medium).

{
  "manifest_version": 3,
  "name": "Productivity helper",
  "version": "1.0.0",
  "permissions": ["debugger", "tabs", "cookies", "history"],
  "host_permissions": ["<all_urls>"]
}

Compliant code

{
  "manifest_version": 3,
  "name": "Productivity helper",
  "version": "1.0.0",
  "permissions": ["storage"],
  "host_permissions": ["https://app.example.com/*"]
}

How to fix

Check that a third-party extension really needs the declared reach; if not, replace it or ask the publisher for a scoped permission set.
If you author the extension, pin host_permissions to the hosts you use and avoid <all_urls> unless the purpose is cross-origin.
Use debugger only for devtools-class extensions; prefer declarativeNetRequest over webRequestBlocking in Manifest V3.

What Vulkro detects​

Non-compliant code​

Compliant code​

How to fix​

References​

What Vulkro detects

Non-compliant code

Compliant code

How to fix

References