---
title: "'Read and change all your data on all websites' (<all_urls>) permission explained."
description: "Why do AI Chrome extensions trigger the scary 'Read and change all your data on all websites' warning? Learn how to tell a safe on-screen reading tool from a data-harvesting extension."
canonical_url: "https://vezz.me/permissions/host-permissions-all-urls/"
type: "pseo-permissions"
category: "permissions"
topic: "Chrome Permission Audit"
intent: "Best for users who paused at the Chrome Web Store install prompt and want to know what '<all_urls>' host permission means in practice."
---

# 'Read and change all your data on all websites' (<all_urls>) permission explained.

Why do AI Chrome extensions trigger the scary 'Read and change all your data on all websites' warning? Learn how to tell a safe on-screen reading tool from a data-harvesting extension.

> **Best fit:** Best for users who paused at the Chrome Web Store install prompt and want to know what '<all_urls>' host permission means in practice.

## Technical Permission Audit

- **Manifest Key:** `host_permissions / content_scripts: ["<all_urls>"]`
- **Chrome Install Warning:** "Read and change all your data on all websites"
- **Risk Level:** Higher

```json
{
  "manifest_version": 3,
  "content_scripts": [
    {
      "matches": ["<all_urls>"],
      "js": ["content.js"]
    }
  ]
}
```

### Legitimate Uses
- Allowing a reading assistant to work on any article, documentation site, academic journal, or blog without a hardcoded domain allowlist
- Listening for your custom keyboard shortcut (e.g., Ctrl+Shift+X) on whichever webpage you happen to be reading
- Rendering the on-screen answer panel directly beside your highlighted text

### Red Flags to Watch For
- Sending page URLs or page content to a backend server on every page load without user action
- No privacy policy or vague disclosure that claims the right to sell 'anonymized browsing streams'
- Requesting `<all_urls>` when the extension only works on a single website like YouTube or Gmail

**How Vezz me handles this:** Vezz me runs on webpages so you can highlight text anywhere and see the answer panel on screen. However, it never collects a browsing-history log and only transmits selected text and optional page context after you explicitly trigger the extension.

## Step-by-step workflow

1. **Check why the tool needs all sites**: A Gmail-only plugin should only ask for `mail.google.com`. A universal reading assistant must run across the web because your reading spans thousands of domains.
2. **Verify user-triggered network behavior**: The most important distinction is 'passive listener' vs 'background broadcaster'. Safe reading tools send zero network traffic until you press their shortcut.
3. **Use Chrome's per-site runtime controls**: You can restrict any `<all_urls>` extension in `chrome://extensions` to run only on specific sites or only when clicked.

## Why Chrome's warning text sounds so extreme

Chrome uses one coarse warning string—'Read and change all your data on all websites'—for any extension that injects a content script across URLs, even if all it does is change a font color or show a tooltip when you press a shortcut.

- 'Read' means the script can read the text you highlight on the page
- 'Change' means the script can insert its answer-panel HTML element into the page DOM
- 'All websites' means the developer didn't restrict the tool to a short list of pre-approved domains

## The 3-minute network audit any user can run

You don't have to guess whether an extension is silently scraping your browsing.

- Open `chrome://extensions`, enable Developer mode, and inspect the extension's Service Worker network tab
- Browse 3–4 normal webpages without pressing the extension's shortcut—outbound API requests should be zero
- Check whether the extension gives you a setting to reduce page context (like Vezz me's `Minimal` context mode, which sends only your selected text)

## Frequently asked questions

### Why does Vezz me need webpage access on all sites?

Because users read across thousands of different domains—arXiv, GitHub, company wikis, news sites, university portals, and technical blogs. Webpage access lets you highlight text and see the floating answer panel on any of those pages without switching tabs.

### Does Vezz me record the websites I visit?

No. Vezz me does not collect a browsing-history log. It only sends selected text, your question, and your chosen level of page context when you actively trigger the extension.

### Can I turn off page context so only my highlighted words are sent?

Yes. In Vezz me's settings, set Page Context Level to 'Minimal'. In Minimal mode, only the exact text you selected and your question are sent—without surrounding paragraphs or headings.

## Related guides

- [Vezz me Privacy Policy](https://vezz.me/privacy/): Read our complete, plain-language data handling and retention disclosures.
- [activeTab permission](https://vezz.me/permissions/activetab/): Learn how user-gesture permissions work in Chrome.
- [AI extension privacy checklist](https://vezz.me/blog/ai-chrome-extension-privacy-checklist/): Full guide to auditing AI browser tools before installing.