debugger

This is a highly specialized permission intended for developer tools.

Examples:

• An extension that provides performance analysis for web pages.
• A tool for testing web applications by automating user interactions.
• An extension that provides a custom debugging UI for a specific JavaScript framework.

This permission triggers a strong warning on installation.

{
  "name": "My Debugger Extension",
  "version": "1.0",
  "manifest_version": 3,
  "permissions": [
    "debugger"
  ],
  "host_permissions": [
    "<all_urls>"
  ]
}

Why is it risky?

This is one of the most powerful and dangerous permissions. It gives an extension the same level of control over a webpage as a developer using debugging tools. A malicious extension with this permission could:

• Steal your passwords and credit card numbers by monitoring what you type into forms.
• Read all your data on any website, including private messages and financial information.
• Perform actions on your behalf, like clicking buttons or sending messages.

Chrome shows a warning banner at the top of any page being controlled by this permission. You should only ever use extensions that need this permission for web development purposes and only from sources you trust completely.

This example attaches the debugger to the active tab and logs all network requests to the console.

// background.js

chrome.action.onClicked.addListener(async (tab) => {
  const debuggee = { tabId: tab.id };

  try {
    // Attach the debugger to the tab
    await chrome.debugger.attach(debuggee, "1.3");
    console.log(`Debugger attached to tab ${tab.id}.`);

    // Enable the Network domain
    await chrome.debugger.sendCommand(debuggee, "Network.enable");

    // Add a listener for network events
    chrome.debugger.onEvent.addListener((source, method, params) => {
      if (source.tabId === tab.id && method === "Network.requestWillBeSent") {
        console.log("Request:", params.request.url);
      }
    });

  } catch (error) {
    console.error(`Failed to attach debugger: ${error}`);
  }
});