Firefox extensions request permissions when you install them. These appear in a dialog before installation. Many users click through without reading them. Here is what the common permissions actually mean.
The common permissions
tabs: the extension can read the URLs and titles of your open tabs. Required for tab management extensions. Does not give access to page content.
activeTab: the extension can access the current tab only, and only while the extension's popup is open or a user action triggered it. More limited than tabs.
storage: the extension can read and write data in Firefox's extension storage (browser.storage.local and browser.storage.sync). Used for saving preferences and user data. This data is not accessible to web pages.
downloads: the extension can trigger file downloads. Required for extensions that save files to your computer (voice recordings, exports).
geolocation: the extension can read your location. Required for weather and dark mode scheduling by sunset/sunrise. Firefox will show a separate permission prompt for this.
<all_urls> or *://*/*: the extension can run JavaScript on all web pages (content script permission). Required for extensions that modify web pages (dark mode, grammar checkers, etc.).
notifications: the extension can show browser notifications. Used for alarms, reminders, etc.
Permissions to scrutinize
<all_urls> with remote code loading: an extension that runs on all pages AND loads scripts from external servers is a significant risk. It can be updated to run malicious code without your knowledge. Look for extensions that bundle all code locally.
webRequest + <all_urls>: allows intercepting all network requests. Legitimate uses (content blockers, privacy tools), but powerful. Only trust well-reviewed extensions with this combination.
nativeMessaging: allows the extension to communicate with applications on your computer. Very rarely needed; treat with caution.
The 11 extensions I built
For reference, here are the permissions each extension uses and why:
| Extension | Key permissions |
|---|---|
| NightOwl | <all_urls> (content script), storage, tabs |
| Voice Notes | microphone, downloads, storage |
| Tab Manager | tabs, sessions, storage |
| News Widget | storage (uses fetch for RSS) |
| Weather Clock | storage, geolocation |
| Stock Market | storage (uses fetch for market data) |
| Daily Planner | storage (new tab page) |
| Habit Tracker | storage (new tab page) |
| Quick Calculator | storage (new tab page) |
| Speed Dial | storage (new tab page) |
| AI Writing | activeTab, storage |
None request webRequest with remote code loading, nativeMessaging, or <all_urls> with external script loading.
How to review permissions yourself
Before installing any extension:
- Check the permissions shown in the install dialog
- Look at the AMO listing — permissions are listed on the "Technical Details" tab
- Check the reviews for any mention of unexpected behavior
- For security-sensitive extensions, consider checking the source code (AMO allows code review)
I built 11 Firefox extensions — see the full series.
