Bug 290508 – Browser asking for permissions for every site when <all_urls> or *://*/* added as an optional permission

• Status: NEW
• Component: WebKit Extensions

[Ajay]

Created attachment 474733 [details]
Extension permission prompt

Tested on Safari Technology Preview 18.4 Release 215

Steps to reproduce:

Step 1: Load a web extension with the following in the manifest

Manifest v2 example:

{
  "name": "Extension",
  "short_name": "Extension",
  "version": "1.0",
  "default_locale": "en",
  "description": "Description",
  "homepage_url": "https://example.com",
  "icons": {
    "16": "icons/icon.png",
    "32": "icons/icon.png",
    "64": "icons/icon.png",
    "128": "icons/icon.png",
    "256": "icons/icon.png",
    "512": "icons/icon.png",
    "1024": "icons/icon.png"
  },
  "permissions": [],
  "optional_permissions": [
    "*://*/*"
  ],
  "manifest_version": 2
}

Manifest v3 example:

{
  "name": "Extension",
  "short_name": "Extension",
  "version": "1.0",
  "default_locale": "en",
  "description": "Description",
  "homepage_url": "https://example.com",
  "icons": {
    "16": "icons/icon.png",
    "32": "icons/icon.png",
    "64": "icons/icon.png",
    "128": "icons/icon.png",
    "256": "icons/icon.png",
    "512": "icons/icon.png",
    "1024": "icons/icon.png"
  },
  "permissions": [],
  "optional_host_permissions": [
    "*://*/*"
  ],
  "manifest_version": 3
}

Step 2: Visit a site that performs async requests (example: https://dictionary.cambridge.org/dictionary/english/test)

Expected: Extension icon will stay grey, as only optional host permissions are requested
Actual: Extension icon shows a warning icon and requests access to gum.criteo.com

[Radar WebKit Bug Importer]

<rdar://problem/147990162>

[Ajay]

This bug applies with both *://*/* and <all_urls>

[Ajay]

This bug has not been fixed in Safari 18.6 and is still occurring