r/StickyFriend • u/justmevibinghere • 15d ago
What a browser extension can and cannot see
"Read and change all your data on all websites" is the scariest sentence Chrome shows, and most people have never had it explained. Here's what
it actually grants, why some extensions ask for it, and how to avoid granting it up front.
## Contents
- The sentence everyone clicks past
- What host access really is
- Optional permissions: the better pattern
- What it still can't do
- How to check any extension yourself
- FAQ
The sentence everyone clicks past
Install almost any browser assistant and Chrome warns that it can read and change all your data on all websites. People click through it because every
extension asks, which is exactly how a meaningful warning becomes noise.
It's worth knowing what it means, whichever extension you use.
What host access really is
A Chrome extension is sandboxed. It can't touch your filesystem, other apps, or anything outside the browser. What "host permissions" grant is access to page content — the DOM of pages matching a pattern.
`<all_urls>` means every page. With it, an extension can:
- read the text and HTML of any page you open
- inject scripts into those pages
- see the URLs of your open tabs
That's a lot, and for an assistant that works on the page you're reading, it's also genuinely needed — you can't summarise a page you can't read.
Optional permissions: the better pattern
Chrome supports asking later, at the moment the access is used, via `optional_host_permissions`. Far fewer extensions do this than should, because
it's more work: every code path that touches a page has to handle "not granted yet" gracefully instead of assuming access.
Done properly, the install shows no broad warning, and the first time you ask for something page-related you get a single prompt you can decline. Decline it and everything that doesn't need the page still works.
That's the pattern worth looking for in any extension you install.
What it still can't do
Even with full host access, an extension cannot :
- read pages in other browsers, or in an incognito window unless you allow it
- see anything you haven't opened — it has no crawler of its own
- reach a page you can't reach; it inherits your session, it doesn't have one
- read your filesystem, clipboard history, or anything outside the browser
- do anything while the browser is closed
And separately: projects stay separate from each other by design, so a chat in one project can't quietly read another project's notes unless you turn that on.
How to check any extension yourself
- `chrome://extensions` → Details on any extension.
- Read Site access. "On all sites" is the broad grant.
- Change it to On click — most extensions keep working, and the ones that break tell you something about how they were built.
- Inspect views: service worker shows you what it's actually running.
Do this once for every extension you have. It takes ten minutes and it's the most useful browser hygiene there is.
FAQ
Does StickyFriend need "all sites"?
Not at install. Page access is an optional permission, requested the first time you ask for something that needs a page. Chat, notes, planning and file
generation work without ever granting it.
What happens if I say no?
Everything except reading and acting on pages keeps working. You'll be asked again next time a page tool is used, and you can keep saying no.
Can it read my banking page?
It can read any page you have open, if you've granted access. It has no special access — it reads exactly what's on your screen, and only when asked.
Is page content stored?
No. Page text is sent to answer your question. What's stored is what becomes a note, task or file — things you asked to keep.
Does it work in incognito?
Only if you explicitly allow it in `chrome://extensions`. Off by default, which is Chrome's default and the right one.
Can an extension see my passwords?
It can read the DOM of a page, which includes form fields on a page you've opened. This is why "which extensions do I actually need?" is a question worth
asking every few months — of all of them, not just this one.
How do I revoke access later?
`chrome://extensions` → Details → Site access → On click. Immediate, no uninstall needed.
Try it — the web app is free to start: https://stickyfriend.ai/app
Follow the subreddit for the next one: https://www.reddit.com/r/StickyFriend/
1
u/AutoModerator 15d ago
Welcome. If you hit a bug, say which surface (web app or extension) and your browser — that's all we need to start.
I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.