It's a similar idea I shared with Moz people last year when asked about how privacy concerns raised in manifest v3 could be addressed, I quote myself: === > T

It's a similar idea I shared with Moz people last year when asked about how privacy concerns raised in manifest v3 could be addressed, I quote myself: === > The host permission in current extension framework does not distinguish between accessing all the data and connecting to any remote server. > > The key issue I see is that it also allows uBO to connect to any remote server. I think it would help a lot to have a _separate_ permission for remote server access, since this is the key privacy issue here: user data leaving the browser to be collected by a remote server. > > So what about a new permission specifically dedicated to specify where an extension is allowed to connect? Without this permission, an extension wouldn't be allowed to connect to a remote server, i.e. unable to leak user data. === As a mental framework, I consider the ability to see the URL of all requests or all the DOM to be a read operation, while extensions making requests to remote server (directly or indirectly) is a write operation (to the wide internet). The latter is where the real privacy concerns are, and this is what should be tackled in some manner. I don't see manifest v3 addressing this[1]. * * * [1] https://www.eff.org/deeplinks/2019/07/googles-plans-chrome-extensions-wont-really-help-security https://www.eff.org/deeplinks/2019/07/googles-plans-chrome-e...