---
title: "Chrome webRequest & declarativeNetRequest permissions: why AI reading tools shouldn't need them."
description: "What do webRequest and declarativeNetRequest do in Chrome extensions? Learn why ad blockers need network interception—and why an AI reading assistant usually shouldn't."
canonical_url: "https://vezz.me/permissions/webrequest/"
type: "pseo-permissions"
category: "permissions"
topic: "Chrome Permission Audit"
intent: "Best for security reviewers checking whether an AI Chrome extension is intercepting browser network traffic or modifying HTTP headers."
---

# Chrome webRequest & declarativeNetRequest permissions: why AI reading tools shouldn't need them.

What do webRequest and declarativeNetRequest do in Chrome extensions? Learn why ad blockers need network interception—and why an AI reading assistant usually shouldn't.

> **Best fit:** Best for security reviewers checking whether an AI Chrome extension is intercepting browser network traffic or modifying HTTP headers.

## Technical Permission Audit

- **Manifest Key:** `webRequest / declarativeNetRequest`
- **Chrome Install Warning:** "Block content on any page" or "Read and change all your data on all websites"
- **Risk Level:** Higher

```json
{
  "manifest_version": 3,
  "permissions": ["declarativeNetRequest", "webRequest"]
}
```

### Legitimate Uses
- Ad blockers and privacy shields (like uBlock Origin Lite) filtering tracker requests
- Developer debugging tools inspecting API headers or CORS rules

### Red Flags to Watch For
- A simple AI summarizer or reading extension asking for `webRequest` across all domains
- Modifying outbound links or injecting affiliate tracking parameters into e-commerce requests

**How Vezz me handles this:** Vezz me does NOT request `webRequest` or `declarativeNetRequest`. It never intercepts, blocks, or inspects your browser's network traffic.

## Step-by-step workflow

1. **Match network permissions to product category**: Network interception belongs in ad blockers, VPNs, and HTTP debuggers—not in text summarizers or reading assistants.
2. **Check host permission scope**: An AI extension only needs host permission for its own backend API (to fetch AI responses) plus DOM access for the text you select.
3. **Reject unnecessary traffic observers**: If an AI extension requests `webRequest` without a clear developer-tooling reason, look for a cleaner alternative.

## How webRequest differs from normal API calls

An extension does not need `webRequest` to make normal `fetch()` calls to its own AI server. `webRequest` is specifically for observing or intercepting the browser's other network requests.

- Normal AI extensions use `fetch()` inside their background service worker to talk to their own API endpoint
- `webRequest` lets an extension observe URLs, query parameters, and headers of subresources loading across pages
- Manifest V3 replaced most blocking `webRequest` uses with `declarativeNetRequest` to improve privacy

## Why Vezz me keeps network permissions minimal

Vezz me's background service worker communicates strictly with the Vezz me API (`vezz-me-api.ithinkisee8.workers.dev`) when you ask a question or check subscription status.

- No `webRequest` or `declarativeNetRequest` permissions requested
- No third-party analytics SDKs or ad networks embedded in the extension
- Outbound requests occur only when you trigger an answer or manage your account

## Frequently asked questions

### Does an AI Chrome extension need webRequest to talk to OpenAI or its backend?

No. Standard `fetch()` requests from an extension's service worker only require host permission for the destination API domain. They do not require `webRequest`.

### Does Vezz me use webRequest?

No. Vezz me does not request `webRequest` or `declarativeNetRequest` and never observes your browser's network traffic.

## Related guides

- [Permission checker matrix](https://vezz.me/ai-chrome-extension-permission-checker/): Review all high, medium, and low risk Chrome permissions.
- [Chrome tabs permission](https://vezz.me/permissions/tabs/): Understand how tab metadata access works in Chrome.
- [Host permissions (<all_urls>)](https://vezz.me/permissions/host-permissions-all-urls/): How to audit content script access safely.