[nojito]

Extension devs are notoriously lazy in that they just build first without thinking about the bare minimum permissions that they need to function.

I believe Pushbullet got caught using too many permissions recently.

[gowld]

Browsers don't provide simple tools to audit permission needs.