Browsers show extension permissions as a blunt warning at install time. Here is what each one is genuinely for.
Site Access
Read and change all your data on all websites (http://*/*, https://*/*)
The one that looks alarming, and the one an SEO tool cannot avoid. The extension analyses whatever page you are on. Restricting it to a list of sites would mean granting permission separately for every client site, every competitor, every SERP.
What it actually does with that access: reads the page’s HTML to pull out titles, meta tags, headings, links, images and structured data. It does not transmit page content. See Data and Privacy.
Note that this covers http and https only. Local files (file://) are not included.
Feature Permissions
| Permission | What it’s for |
|---|---|
activeTab |
Act on the tab you are currently looking at when you click the toolbar icon. |
contextMenus |
Build the “Sprout SEO Extension” right-click menu. |
storage |
Remember your settings, cached captures, projects and brand lists. |
unlimitedStorage |
Lifts the roughly 10MB cap on extension storage. A long AI Insights history plus a large bulk run will exceed it, and hitting the cap causes silent data loss. |
webRequest |
Read response headers and status codes for the HTTP Headers tab and the toolbar status badge. On Firefox it also carries the AI capture mechanism. |
webNavigation |
Know when a page finished loading, so the toolbar icon and badge reset correctly. |
cookies |
Clear Google’s location cookie when you press Reset in the local search simulator. |
scripting |
Run the capture script for View Rendered Source, and inject the AI Overview reader. |
contentSettings |
Toggle JavaScript on and off. Chrome and Edge only. |
declarativeNetRequestWithHostAccess |
Set the request headers behind the local search simulator’s location override, and block JavaScript where contentSettings is unavailable. |
webRequestBlocking |
Firefox only. Firefox’s equivalent mechanism for the two jobs above. |
What Is Not Requested
- No
historypermission. The extension cannot read your browsing history. - No
bookmarks,downloads,topSites,geolocation,identityormanagement. - No optional permissions. There is no hidden second tier that gets requested later.
- No native messaging. Nothing talks to software on your computer.
Why Permissions Differ Between Browsers
Chrome and Edge run Manifest V3, Firefox runs Manifest V2, and the two platforms expose different APIs for the same jobs. That is why contentSettings and scripting appear on Chrome and Edge, and webRequestBlocking on Firefox.
One user-visible consequence: the local search simulator’s location override needs an API Firefox does not have, so it works on Chrome and Edge only. Language and device overrides work everywhere.
Verifying This Yourself
The full permission list is in the extension’s manifest.json, which you can read in the unpacked extension folder or by unzipping the package from the store. Every network request the extension makes is visible in your browser’s DevTools Network panel. You do not have to take this page’s word for any of it.