Chrome Permission Audit

'Read and change all your data on all websites' (<all_urls>) permission explained.

Why do AI Chrome extensions trigger the scary 'Read and change all your data on all websites' warning? Learn how to tell a safe on-screen reading tool from a data-harvesting extension.

Best fit

Best for users who paused at the Chrome Web Store install prompt and want to know what '<all_urls>' host permission means in practice.

Technical Manifest Audit

Permission specification & risk profile.

Review how Chrome enforces host_permissions / content_scripts: ["<all_urls>"] in Manifest V3 and how to tell legitimate user-triggered extensions apart from intrusive tools.

Risk level: Higherhost_permissions / content_scripts: ["<all_urls>"]
Chrome install-time warning
"Read and change all your data on all websites"
Manifest V3 declaration
{
  "manifest_version": 3,
  "content_scripts": [
    {
      "matches": ["<all_urls>"],
      "js": ["content.js"]
    }
  ]
}
Legitimate uses vs. red flags
What to verify before granting this permission to an AI browser tool.

Legitimate AI reading uses

  • Allowing a reading assistant to work on any article, documentation site, academic journal, or blog without a hardcoded domain allowlist
  • Listening for your custom keyboard shortcut (e.g., Ctrl+Shift+X) on whichever webpage you happen to be reading
  • Rendering the on-screen answer panel directly beside your highlighted text

Red flags to watch for

  • Sending page URLs or page content to a backend server on every page load without user action
  • No privacy policy or vague disclosure that claims the right to sell 'anonymized browsing streams'
  • Requesting `<all_urls>` when the extension only works on a single website like YouTube or Gmail
How Vezz me handles this: Vezz me runs on webpages so you can highlight text anywhere and see the answer panel on screen. However, it never collects a browsing-history log and only transmits selected text and optional page context after you explicitly trigger the extension.
Step-by-step workflow

How to run this workflow in place.

1

Check why the tool needs all sites

A Gmail-only plugin should only ask for `mail.google.com`. A universal reading assistant must run across the web because your reading spans thousands of domains.

2

Verify user-triggered network behavior

The most important distinction is 'passive listener' vs 'background broadcaster'. Safe reading tools send zero network traffic until you press their shortcut.

3

Use Chrome's per-site runtime controls

You can restrict any `<all_urls>` extension in `chrome://extensions` to run only on specific sites or only when clicked.

Key details

Why this approach works better than switching tabs.

Why Chrome's warning text sounds so extreme
Chrome uses one coarse warning string—'Read and change all your data on all websites'—for any extension that injects a content script across URLs, even if all it does is change a font color or show a tooltip when you press a shortcut.
  • 'Read' means the script can read the text you highlight on the page
  • 'Change' means the script can insert its answer-panel HTML element into the page DOM
  • 'All websites' means the developer didn't restrict the tool to a short list of pre-approved domains
The 3-minute network audit any user can run
You don't have to guess whether an extension is silently scraping your browsing.
  • Open `chrome://extensions`, enable Developer mode, and inspect the extension's Service Worker network tab
  • Browse 3–4 normal webpages without pressing the extension's shortcut—outbound API requests should be zero
  • Check whether the extension gives you a setting to reduce page context (like Vezz me's `Minimal` context mode, which sends only your selected text)
Frequently asked questions

Common questions about chrome permission audit.

Why does Vezz me need webpage access on all sites?

Because users read across thousands of different domains—arXiv, GitHub, company wikis, news sites, university portals, and technical blogs. Webpage access lets you highlight text and see the floating answer panel on any of those pages without switching tabs.

Does Vezz me record the websites I visit?

No. Vezz me does not collect a browsing-history log. It only sends selected text, your question, and your chosen level of page context when you actively trigger the extension.

Can I turn off page context so only my highlighted words are sent?

Yes. In Vezz me's settings, set Page Context Level to 'Minimal'. In Minimal mode, only the exact text you selected and your question are sent—without surrounding paragraphs or headings.

Related workflows & guides

Explore connected pages.

Vezz me Privacy Policy
Read our complete, plain-language data handling and retention disclosures.
Open guide
activeTab permission
Learn how user-gesture permissions work in Chrome.
Open guide
AI extension privacy checklist
Full guide to auditing AI browser tools before installing.
Open guide
All Extension Security & Permissions
Browse the complete directory of extension security & permissions on Vezz me.
View hub directory
Available for Chrome and Firefox

Ready to try this workflow on your own reading?

Install Vezz me free, highlight text on any webpage, and press your customizable shortcut (default: Ctrl+Shift+X or Cmd+Shift+X on Mac) to get an answer right beside the source.

Install free for ChromeInstall free for FirefoxCompare plans