I've been developing a few internal chrome apps for my company recently and you're mostly right. Most chrome applications ask for essentially r/w access to the

I've been developing a few internal chrome apps for my company recently and you're mostly right. Most chrome applications ask for essentially r/w access to the page and users don't understand what it means to click yes. With this you are essentially keylogging yourself on every single website you visit. Like damn. I will say it is possible to view the manifest.json file of any installed application, meaning you can get a complete list of all allowed permissions and any host based restrictions 'good' chrome apps will often include. Google and other browser vendors know what's happening. They know how many users have agreed to what permissions. They know most chrome apps ask for excessive permissions. It's just like Android. The right thing is to invest in more robust permission systems and training users indirectly to understand permissions better, but that would lose them money so they don't.