A Chrome extension needs the cookies permission and host permissions for a site before it can use the cookies API on that site's cookies. Together they can read session cookies for every site the extension covers. HttpOnly protects cookies from page scripts, but Google's cookies reference does not say it blocks the extension API.
What the API requires
According to the reference, the manifest must declare the cookies permission and also host permissions for any hosts whose cookies the extension will access. Without a host permission for the cookie's URL, the call fails, and getAll() only returns cookies for domains the extension has host access to.
So the permission has two parts, and the second part is the one that shows how much access it has. An extension with cookies plus access to all sites is a different thing from cookies plus one site.
The HttpOnly question
The HttpOnly flag means a cookie is inaccessible to client-side scripts. The reference defines the property that way. It does not state whether the extension API can read those cookies, so do not assume protection. If your risk model depends on this, check the current documentation and test in your own browser.
What is safe to say: HttpOnly is aimed at page script attacks like cross-site scripting. An extension with the right permissions sits in a different position, and you should treat it as trusted software with access to your sessions. See session cookie myths and facts for what theft of a session cookie allows.
Why reviewers care
Session cookies are often the real keys to an account. An extension that can read them for your email, code host or cloud console does not need your password. Even MFA does not help once a valid session is copied.
How to check your own setup
- Open the extension's details and review site access. Choose "on click" or specific sites where you can. See site access options.
- Look for the cookies permission in the manifest or the listing's permissions summary.
- Ask whether the function of the extension needs cookies at all. A color picker does not.
- For work accounts, remove extensions that combine cookies with all sites and no clear reason.
For administrators
Chrome's ExtensionSettings policy can block specific API permissions, and extensions that require a blocked permission will not install. See how the policy works.
Common mistakes
Users often look only at the permission name and skip site access. Admins sometimes block cookies access in one place and miss the same data reachable through other means. Review the combination of permissions and hosts, and test against a throwaway account before relying on a control.
Quick check
Is the cookies permission enough by itself?
No. The reference says host permissions for the relevant sites are also required.
Does HttpOnly stop an extension from reading a cookie?
Google's reference does not say. Do not rely on it as a protection against extensions.
Sources
Last reviewed: 19 October 2026.
