The activeTab permission gives an extension temporary access to the tab you are using, but only when you invoke the extension by clicking it, using a shortcut or picking a menu item. Access ends when you leave the site or close the tab. It shows no install warning.
What it grants
According to Chrome's documentation, activeTab lets an extension run scripts or insert styles on the current tab if it also declares the scripting permission. It can read the tab's URL, title and favicon, and it can intercept network requests to the main frame origin.
When access begins and ends
Access starts when you do something deliberate: click the extension's toolbar button, run its context menu item, use a keyboard shortcut it registered, or accept one of its address bar suggestions.
It ends when you navigate to a different site or close the tab. Moving between pages on the same site keeps access. Restricted pages, such as chrome pages, never receive it.
Why it matters for safety
The alternative is a broad host permission, which gives the extension standing access to many sites. Chrome shows a warning for that at install. activeTab shows no warning because the user's own action is the trigger.
The docs also state a clear security benefit. If an extension is compromised, an attacker would have to wait for you to invoke it, and the access disappears when you navigate away. Compare that with a standing grant that works silently in the background.
How to read this as a user
When you review an extension, look at what it asks for. If a simple page tool asks for access to every site, ask why it did not use activeTab. There are legitimate answers, for example tools that must act on page load. But for a tool you trigger by hand, activeTab is the right design.
You cannot see the manifest from the Chrome UI directly, but the site access setting and the store listing give clues. For a deeper look, the extension's source is a folder of files on your disk that you can inspect.
What activeTab does not do
It does not make an extension harmless. During the time it has access, the extension can read what is on that tab. If you click an unknown extension on your bank page, you have given it that page. The permission narrows exposure in time and scope, not in trust.
For developers building extensions
If you write extensions, prefer activeTab or optional host permissions over broad grants. Your users will see fewer warnings, and a bug or compromise in your code has a smaller blast radius. See also match patterns explained.
Quick check
Does activeTab work in the background?
No. It is granted by a user action such as a click or shortcut, and it expires when you leave the site or close the tab.
Does activeTab show a warning during install?
No. Chrome's documentation says it displays no warning message during installation.
Sources
- The activeTab permission (Chrome for Developers)
- Permission warnings (Chrome for Developers)
- Declare permissions (Chrome for Developers)
Last reviewed: 19 October 2026.
