Chrome extension now requires "read and change all your data on the websites you visit".

[hrez]

Chrome extension now requires "read and change all your data on the websites you visit".
What's the reason for this new permission?
Can it be re-deployed without this permission to be a requirement?

Client app information

extension version: 1.4.0
source: Chrome Web Store
Chrome Version 69.0.3497.100 (Official Build) (64-bit)

[nero120]

Hi @hrez, yes this may be possible but I need to do some testing to confirm. Will look into it for the next version.

[hrez]

Hi, looking forward, thanks.
FYI, check out https://chrome.google.com/webstore/detail/xbrowsersync/lcbjdhceifofjlpecfpeimnnphbcjgnc support on the same topic in case you are not aware.

[nero120]

Thanks @hrez.

I've had a chance to do some testing and unfortunately I can't get around requesting this permission. The reason is that in order to automatically add HTML page metadata when the user clicks the native "Add Bookmark" button, the background script must be able to call tabs.executeScript against the page, which it can only do if the page's URL has been added to the manifest permissions. And, as this can happen on any page (i.e. any URL), the extension must have the <all_urls> permission which is displayed to the user as "read and change all your data on the websites you visit".

The only place this permission is required is in the desktop browser platform implementation getPageMetadata function (e.g. here for Chrome).

I'm therefore going to close this issue, please respond back if you have any further questions.

[nero120]

@hrez I managed to find a workaround so the next version (v1.4.1) will no longer require the "read and change all your data on the websites you visit" permission.

[hrez]

Thanks @nero120
Appreciate all the effort.