Why Exactly The Permission List Doesn't Address This
An add-on keeps phoning home — is that normal?
The question comes up for anyone who has ever opened a network monitor with extensions installed. Traffic from an empty tab looks alarming, and telling who is sending it and why is hard at first glance. It is worth learning how to distinguish a harmless update from telemetry.
I installed a popular add-on for tabs, and everything seems to work. But the network monitor shows it contacting some third-party domain once a minute, even when the tab sits idle. The description does not mention it. Is this tracking, or am I reading too much into it?
The first move is to separate yours from theirs: turn off all extensions in one go and see whether the background noise disappears. If it goes quiet, the source is one of them, and you switch each back on individually until the traffic returns. That isolates the culprit in two minutes flat, no guesswork.
If there is still no answer, a simple check helps: a required update goes to the author's domain and to the point, while telemetry runs nonstop, in the background, to a third-party server. The second kind almost always hides in the settings behind a toggle nobody knows about.
Why exactly the permission list doesn't address this
Access to tabs in the manifest and sending their list out are two different things, and a single permission line can't distinguish them. Formally the add-on honestly declares access; what it does with that access isn't visible from the manifest. So watch the traffic, not the permission list.
It is simpler not to guess each time and leave tools for webmasters within reach — ones that say plainly they collect nothing. And this tab task is painless to close with a telemetry-free stand-in — browser clutter and annoyances, behaves the same and does not call home.
Reviews like this are valuable not for paranoia but for the habit: a few minutes with the network monitor after the install, and "pinging somewhere" becomes a plain picture of what goes where.