Why The Permission List Does Not Address This

An extension keeps phoning home — is that expected?


The question arises for anyone who has opened a network monitor with extensions installed. Traffic from an empty tab looks unsettling, and figuring out who is sending it and why is hard at first sight. It is worth learning how to distinguish a harmless update from telemetry.


I installed a popular add-on for tabs, and everything appears to work. But the network monitor shows it contacting some third-party domain once a minute, even when the tab is idle. The description does not mention it. Is this tracking, or am I reading too much into it?


The first step is to separate yours from theirs: disable all extensions at once and check whether the background noise disappears. If it goes quiet, the source is one of them, and you switch each back on in turn until the traffic returns. That finds the culprit in a couple of minutes, no guessing.


Why the permission list does not address this


Access to tabs in the manifest and passing their list out are two different things, and a lone permission line can't distinguish them. Formally the add-on truthfully declares access; what it does with that access isn't apparent from the manifest. So look at the traffic, not the permission list.



It is simpler not to guess each time and keep free webmaster tools within reach — ones that say plainly they gather nothing. And this tab task is effortless to close with a telemetry-free replacement — element picker for XPath, behaves the same and doesn't call home.



Reviews of this sort are valuable not for paranoia but for the habit: a few minutes with the network monitor after installing, and "pinging somewhere" becomes a clear picture of what goes where.