Why the warning sounds so scary
Chrome shows the same blunt phrasing — "Read and change all your data on all the websites you visit" — to every extension that requests broad host access, regardless of what it actually does with it. It's a technical description of the capability being granted, not a claim about what the extension actually does. That's exactly why permissions are worth understanding individually rather than judging by the scariest-sounding line.
Permission by permission
declarativeNetRequest
Lets the extension hand Chrome a list of rules ("block requests to these domains") and have Chrome itself do the blocking. The extension doesn't see or log the URLs you visit — Chrome evaluates the rules internally. This is the modern, more private replacement for the older approach (raw webRequest blocking), which did let an extension inspect every request directly.
host_permissions: <all_urls>
The one that reads scariest, and the one this whole post is about. An ad/tracker/popup blocker has to be able to run on any site, because that's where ads and trackers actually are — there's no fixed list of "sites with ads" to scope this down to. The alternative Chrome sometimes suggests, activeTab, only grants access when you manually click the extension's icon for that one tab, which would mean clicking the extension on every single page load. That defeats the purpose of an always-on ad blocker.
storage
Saves your own on/off preferences (and, locally, a count of what's been blocked) so they persist between browser sessions. In a trustworthy extension, this data stays on your device or in your own browser's sync — not on a server the developer operates.
tabs
Usually just reads which site the active tab is on, so a toolbar popup can show a "disable on this site" toggle for the right domain. Doesn't imply reading page content or browsing history.
webRequest (observational)
Used in its non-blocking form, this only detects that a request was already blocked by declarativeNetRequest — useful for showing a "blocked count," but it doesn't let the extension block, modify, or read request contents itself.
alarms
Schedules something to run periodically — commonly a check for an updated block list, similar to how antivirus software checks for new definitions.
How to sanity-check any extension's permissions
- Does each permission map to a stated feature? If an ad blocker asks for something like contacts or location access, that's a mismatch worth questioning.
- Is there a specific justification, not just a category name? The Chrome Web Store now requires developers to explain each permission in plain English — read that explanation before installing.
- Is the data-collection answer "none," and is that plausible given what the extension does? An extension that only blocks requests locally has no real reason to phone home.
- Is the source inspectable? An unpacked/open extension can be read line by line; that's a meaningfully different trust situation than a black box.
FAQ
Can an ad blocker steal my data?
Technically, broad host permissions would allow a malicious extension to do that — which is exactly why the permission itself isn't proof of anything either way. What matters is the specific extension's actual code and its stated data practices, not the mere presence of a broad permission that most ad blockers legitimately need.
Why does an ad blocker need access to "all sites" instead of just a few?
Because ads, trackers, and popups can appear on effectively any site you visit — scoping the permission down to a fixed list would mean the blocker stops working the moment you visit a site not on that list.
What's the difference between declarativeNetRequest and the old webRequest blocking?
declarativeNetRequest has the browser itself evaluate a rule list and block matching requests, without the extension seeing the traffic. The older blocking-webRequest approach let an extension inspect and modify every request directly, which is more powerful but also more invasive — and is now restricted for most extensions under Chrome's current extension platform.