Why The Permission List Doesn't Answer This

An extension keeps calling home — is that expected?


The question comes up for anyone who has opened a network monitor with extensions installed. Traffic from an empty tab looks worrying, and telling who is sending it and why is difficult at first sight. It is worth understanding how to separate a benign update from telemetry.


I set up a popular add-on for tabs, and everything works. But the network monitor shows it hitting some third-party domain once a minute, even when the tab is idle. The description does not mention it. Is this tracking, or am I reading too much into it?


The first move is to separate yours from theirs: turn off all extensions in one go and check whether the background noise stops. If it goes quiet, the cause is one of them, and you switch each back on individually until the traffic returns. That pins down the culprit in a couple of minutes, no guessing.



If there is still no answer, a simple test helps: a required update goes to the author's domain and to the point, while telemetry runs continuously, in the background, to a third-party server. The second kind nearly always hides in settings behind a toggle nobody knows about.


Why the permission list doesn't answer this


Access to tabs in the manifest and sending their list outward are two different things, and a single permission line can't distinguish them. Formally the add-on honestly declares access; what it does with that access is not visible from the manifest. So watch the traffic, not the permission list.



It is simpler not to guess every time and keep browser extensions for webmasters within reach — ones that state plainly they gather nothing. And this tab task is painless to close with a telemetry-free swap — Flexible Variants support, works the same and doesn't call home.



Reviews of this sort are useful not for paranoia but for the habit: a couple of minutes with the network monitor after installing, and "pinging somewhere" turns into a plain picture of what goes where.