[gorhill]

> the newer APIs do not share all my web traffic with the extensions

The webRequest API can observe the URLs you visit without needing blocking permission.

And so does the webNavigation API, the tabs API, history API, content scripts, possibly cookies API and whatever else does not come to my mind.

[SquareWheel]

Shouldn't those be visible in the permissions prompt, prior to installing the extension?