The update that disables itself
An extension you have used for months suddenly stops working and Chrome asks whether you want to allow it to do something new. That prompt is one of the most expensive events in an extension’s life — for you, because it is genuinely worth reading, and for whoever built it, because most people do not.
Chrome will not widen an extension’s access silently. If an update asks to reach more than the version you approved, the extension is disabled and waits for you. That is the protection working — but it fires identically whether the change was harmless or not, and it cannot tell you which.
Why it costs so much
There is a published account of a developer adding tabCapture to an extension
with around 30,000 weekly users and losing roughly 2,000 of them in a single day
— about 7%, for one permission, on a feature that was presumably an improvement.
The mechanism is not mysterious. The extension stops working. A warning appears. Reading it requires understanding what a permission string means. Uninstalling makes the problem go away in one click. A meaningful fraction of people take the fast option, and they are not being unreasonable.
How to read the prompt
The wording matters more than the fact of the prompt:
- “Read and change all your data on all websites” — the broadest one there is. Every page, including your bank and your email, not just the sites you use the extension on. Worth real thought, even for a tool you like.
- “...on example.com” — one named site. If it is the site the extension is for, this is close to unremarkable.
- Read your browsing history — rarely needed by anything that is not explicitly a history tool.
- Capture the contents of your screen — the
tabCapturecase above. Legitimate for a recorder, alarming on anything else.
The useful question is not “is this extension trustworthy” but does its stated purpose obviously require this? A Shopify research panel needs to read Shopify storefronts. It does not need your webmail.
The permission that is not a promise
activeTab deserves its own paragraph, because it is the difference between a
guarantee and an assurance.
It grants access to the tab you are looking at, at the moment you click the icon, and nothing
else. It expires. It cannot fire on its own. An extension built on activeTab
cannot read your browsing — not “does not”, but cannot, because it
was never given the ability. An extension with all-sites access that promises not to read your
browsing is asking you to trust a policy instead of a boundary.
When you see a permission prompt, the most informative thing is often what the extension did not ask for.
What this means if you build them
- Freeze the permission set before you publish. Adding one later is a launch-scale event, not a patch. Ship version one with everything you will need.
- If you must add one, do it while you are small. The cost scales with your install base — the same change that costs nothing at 20 users costs thousands at 30,000.
- Every permission you never request is a prompt you can never trigger. Minimal permissions are not only a privacy position; they are retention insurance.
Every MurmTools extension is built on activeTab and
scripting — nothing runs on any page until you click the icon, and none
of them can read your browsing even if we wanted to. Where one needs more, its page says
exactly what and why.
Questions
Why does Chrome say an extension needs new permissions?
Its update asks to reach something the version you approved could not, so Chrome disabled it and is waiting for you.
Is it safe to re-enable?
Read what it asks for. If the stated purpose does not obviously require it, remove it and check the changelog.
What does activeTab mean?
Access to the tab you are on, only when you click the icon, expiring afterwards.
Why did my extension lose users after an update?
Because the re-approval prompt is alarming and uninstalling is the faster way to dismiss it.