iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
In Manifest V3, choose the permission pattern that matches when and where your extension needs access: use host_permissions for required site access, optional_host_permissions for access requested on demand, content_scripts.matches to target static content scripts, or activeTab with scripting for a user-triggered action on the current tab.
The title’s “8 shipped Chrome extensions” count is not verified by the available official examples: the cited materials establish Google sample extensions, not eight published Chrome Web Store extensions. The examples below are therefore identified as samples, not as shipped store listings.
Which Manifest V3 permission pattern should you use?
| Pattern | Use it when | Access model | Manifest location |
|---|---|---|---|
| Required site access | The extension’s core feature needs access to known sites. | Persistent host access | host_permissions |
| Optional site access | The user may choose to invoke a feature for particular sites. | Requested at runtime | optional_host_permissions |
| Static content-script targeting | A content script should run automatically on specified pages. | Runs on matched pages; this field targets scripts rather than replacing all host permissions. | content_scripts.matches |
| Temporary current-tab access | The user invokes an action that works on the active tab, without needing standing access to sites. | Temporary, tied to user action | activeTab and scripting |
These are not four interchangeable manifest fields. The first three are declaration locations; the fourth is a user-action-based approach to temporary access. Choose the narrowest scope that still supports the feature. Chrome advises using optional permissions when the feature allows it, so users can make an informed choice about access to resources and data (Chrome: Declare permissions).
How do host permissions differ from API permissions?
In Manifest V3, a site URL pattern belongs in host_permissions or optional_host_permissions, not in the permissions array as if it were an API permission name. API capabilities such as scripting are declared in permissions; host patterns describe which sites the extension can access. Keeping these separate makes the requested capability and site scope explicit (Declare permissions; Permission warnings).
#1 Best Overall
Pattern 1: Declare required host access
Use host_permissions when access to specified sites is essential to the extension’s core function. The patterns are declared in the manifest, separately from API permission strings:
{
"manifest_version": 3,
"name": "Example extension",
"version": "1.0",
"host_permissions": ["https://www.example.com/*"]
}Be specific about the sites and URL patterns the feature needs. Adding or changing host patterns can prompt a permission warning, so a broad pattern may create a more consequential access request than a narrow one (Declare permissions; Permission warnings).
Pattern 2: Request optional host access when needed
When the user may choose whether to use a site-specific feature, declare eligible sites in optional_host_permissions and request access at runtime when the feature is invoked. This avoids making that site access a prerequisite at installation. Manifest V3 support for optional_host_permissions was announced for Chrome 102 on April 4, 2022 (Chrome for Developers: Optional host permissions in Manifest V3).
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →{
"manifest_version": 3,
"name": "Example extension",
"version": "1.0",
"optional_host_permissions": ["https://www.example.com/*"]
}At runtime, request the declared site pattern in response to the relevant user action. A request should correspond to a clear feature, rather than asking for access before the user has a reason to understand it. See Chrome’s guidance on declaring permissions for permission request behavior and constraints.
Rank #3
Pattern 3: Target static content scripts with matches
Put URL patterns for automatically injected, statically declared content scripts in content_scripts.matches. This field specifies the pages on which those scripts run; it is not a synonym for host access needed by every other host-sensitive API.
{
"manifest_version": 3,
"name": "Example extension",
"version": "1.0",
"content_scripts": [
{
"matches": ["https://www.example.com/*"],
"js": ["content.js"]
}
]
}Google’s Web Accessible Resources Demo manifest illustrates static content_scripts.matches for three example Glitch hosts. It is an official sample, not evidence that the extension is published in the Chrome Web Store (Web Accessible Resources Demo sample).
Pattern 4: Use activeTab for a user-triggered current-tab action
If the extension only needs to act on the tab the user is currently viewing after they invoke it, activeTab can provide temporary access without requesting persistent access to every site. For programmatic injection, pair it with the scripting permission and inject in response to the user gesture. Google’s Focus Mode sample demonstrates this manifest arrangement (Focus Mode sample).
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Clear out junk files and repair common Windows errors3Fix the driver behind crashes, sound loss and screen glitches{
"manifest_version": 3,
"name": "Example extension",
"version": "1.0",
"permissions": ["activeTab", "scripting"],
"action": {}
}This pattern is a poor fit if the feature must work automatically across sites or needs standing access beyond the user-triggered tab action. In those cases, select a host permission scope appropriate to the behavior.
Best Value
How do dynamic and programmatic content scripts fit?
Static declarations, dynamic registration, and programmatic injection describe different ways to manage content scripts; they do not eliminate the need to choose an appropriate access scope. Google’s scripting API sample demonstrates dynamic declarations and programmatic injection. Depending on the behavior, scripts may need declared host access, or a user-triggered injection may use activeTab (Chrome Extensions scripting API sample; Chrome: Content scripts).
What do the official samples establish?
- Focus Mode: its Manifest V3 manifest declares
scriptingandactiveTab, showing a user-triggered injection pattern (sample). - Web Accessible Resources Demo: its manifest uses static
content_scripts.matchesfor three example Glitch hosts (sample). - Scripting API sample: demonstrates dynamic declarations and programmatic injection (sample).
- Chrome Prompt AI Demo: its Manifest V3 manifest declares the
sidePanelAPI and no host permissions, illustrating that an extension does not necessarily need host access (sample).
Google’s sample repository is official, but these examples do not verify eight extensions currently published in the Chrome Web Store. The “eight shipped” claim should not be attached to these samples (Chrome Extensions samples repository).
Quick Recap
How to choose and validate a permission scope
- Identify the feature’s access need. Decide whether it requires an API capability, access to particular sites, automatic content-script execution, or only a user-triggered action on the current tab.
- Choose the matching declaration. Put required patterns in
host_permissions, requestable patterns inoptional_host_permissions, static script targets incontent_scripts.matches, or useactiveTabwithscriptingfor a temporary, user-initiated injection. - Keep patterns narrow. Avoid requesting access to unrelated sites; changes to host patterns can affect permission warnings.
- Explain the request at the feature point. When asking for optional access, connect the request to the action the user chose, so its purpose is clear.
- Check the manifest against the behavior. Confirm that API permission strings and host URL patterns are in their appropriate fields, and test that scripts run only where intended.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Free tools Windows power users keep installed
One-click scans. No signup required.
