webRequest

• In Manifest V2: This was the primary API for ad blockers and privacy tools.
• In Manifest V3: Its use is limited to extensions that need to observe network traffic for analytical purposes, without modifying it.
  • Developer tools that show network logs.
  • Security extensions that analyze headers for potential threats.

This permission requires host permissions for the URLs you want to observe.

{
  "name": "My Network Analyzer",
  "version": "1.0",
  "manifest_version": 3,
  "permissions": [
    "webRequest"
  ],
  "host_permissions": [
    "<all_urls>"
  ],
  "background": {
    "service_worker": "background.js"
  }
}

Why is it risky?

This permission allows an extension to see the address of every single piece of data your browser sends or receives. This isn't just the websites you visit, but also all the ads, images, tracking scripts, and data requests happening in the background.

This provides a complete, real-time map of your online activity and is highly sensitive. While modern extensions have more limited access, older extensions could also block or change this traffic. A malicious extension could use this to track you in detail. The modern, private alternative for content blocking is declarativeNetRequest.

This example logs the URL of every main frame request before it is sent.

// background.js

chrome.webRequest.onBeforeRequest.addListener(
  (details) => {
    // Log only requests for the main document in a tab
    if (details.type === 'main_frame') {
      console.log(`Navigating to: ${details.url}`);
    }
  },
  {
    urls: ["<all_urls>"] // The filter for which URLs to listen to
  }
);