[sp332]

Bookmarking extensions need access to all webpages though. Only #3 would potentially show something suspicious.

[icebraining]

A bookmarking extension can use the activeTab permission, which gives them access only when the user clicks on the extension button and only to the current tab: https://developer.mozilla.org/en-US/docs/Mozilla/Add-ons/Web...

[sp332]

That's a great feature. Maybe not something people would want on a personal shopper extension though, which is another type of extension that might have done the sraping. It's more convenient to just have a price alert activate when I look at an item on Amazon than having to push a button every time.

[icebraining]

Technically you can do that just with the webNavigation (allows you to see the URLs loaded) and the notifications (to alert the user).

[saagarjha]

This shouldn’t require arbitrary network access, though. You can read the content of pages and have access to browsing history locally.

[sp332]

Right, if someone is using Facebook Messenger in a browser, the message history could be scraped.