Full Page PDF Snap → Permissions and risk

An extension is only as dangerous as its permissions allow

Exactly one year ago, Mozilla warned that add-on developer accounts were being phished. That warning is the reason to stop asking “do I trust this developer?” and start asking a better question: what could this extension do if someone else controlled it tomorrow? The answer is written in its permission list, and it is readable in half a minute.

1 August 2026 · sources linked throughout

A personal report. This is a private account by an individual, not a review by an institution and not a certified test. Measurements are single runs on specific inputs on a stated date; assessments are the author's own opinion. Statements about third-party products come exclusively from publicly declared data with the retrieval date given — nothing was decompiled, and no claim is made about any provider's intentions. The author develops Full Page PDF Snap, which appears in some of these measurements. Corrections: GitHub issues. Details in About & disclosure.

What happened a year ago

On 1 August 2025, Mozilla's add-ons team published a warning about an active phishing campaign aimed at extension developers. The mails claimed an account update was needed to keep developer access:

“Your Mozilla Add-ons account requires an update to continue accessing developer features.” — quoted in Mozilla's warning, Add-ons Community Blog, 1 August 2025

The target was not users. It was the accounts that publish updates. AMO hosts more than 60,000 extensions, and updates install automatically and silently. A developer account in the wrong hands is a delivery channel to everyone who has that extension installed.

This is not a hypothetical class of attack, and Mozilla is not unusual in facing it — it is simply the case that is documented and dated, which is why it is used here.

Why trust is the wrong measure

Judging an extension by its developer's reputation assumes three things that do not hold over time:

That the account stays in the same hands. Phishing is one route. Another is legitimate: extensions get sold, and the new owner inherits the install base.
That you re-evaluate at each update. You do not. Updates arrive on their own, and the permission dialog only reappears when the requested permissions grow.
That today's code is tomorrow's code. What you installed and what runs next month are different artefacts.

Permissions are the one part that does not depend on any of that. They are a hard boundary enforced by the browser, and they define the worst case regardless of who is in control.

What each permission means in the worst case

The useful exercise is not “is this permission normal?” but “what would this permission allow, if the extension were working against me?”

Permission	In the worst case	Severity
<all_urls>	Read and alter every page you open, at any time, without any action from you — including while you are logged into a bank, a mail account or an employer's system	highest
cookies	Read session cookies, which can be equivalent to being logged in as you	highest
history / bookmarks	Read a complete record of what you visit	high
tabs	See URLs and titles of all open tabs, continuously	medium
nativeMessaging	Talk to a program installed on the computer — leaves the browser sandbox	highest
activeTab	Read one tab — and only after you actively start the extension on it. No background access, no history, nothing while you are not looking	limited
downloads, storage, notifications	Write files to the download folder, keep settings, show messages. Annoying if misused, not a data channel by themselves	limited

What this is not

This table is about worst cases, not accusations. <all_urls> is also the straightforward way to build a tool that has to work on every page, and many careful, open-source extensions request it for exactly that reason. A broad permission is a larger blast radius, not evidence of bad intent.

Nor does a narrow permission make an extension safe. It limits what a compromise could reach — that is all it does, and it is worth having precisely because everything else depends on trust holding.

A practical assessment, in order

Before installing

Read the permission list on the listing page, under “Permissions and data”. If it says access your data for all websites, ask whether the function actually requires that.
Match scope against purpose. A tool you invoke deliberately — a screenshot, a converter, a formatter — rarely needs standing access to everything. A content blocker genuinely does.
Check the update date. An extension with broad permissions that has not been touched in years combines the largest blast radius with the least maintenance.
Prefer verifiable over promised. Where the source is public and the submitted files are the source files, claims can be checked instead of believed.
Watch the traffic once if it matters to you: about:debugging → Inspect → Network, then use the extension. Local tools show nothing there.

Applying it to this extension

We build one of the extensions in this category, so here is the same test turned on ourselves. Full Page PDF Snap declares:

activeTab, downloads, downloads.open, storage, menus, notifications, scripting — and no host permissions at all.

In the worst case — the account compromised, a malicious update shipped — the reachable surface is a page on which the user has just pressed the button. There is no standing access to browsing, no cookies, no history, no background window into open tabs. That is not immunity. It is a smaller blast radius, and it is the part that survives when trust does not.

What it explicitly does not do

It does not encrypt the resulting PDF, does not set a password on it, does not strip metadata, does not anonymise anything and does not hide your IP address. There is no code for any of that — you can check: the words encrypt, password and anonym do not appear in the source.

A PDF it produces is an ordinary file in your download folder, readable by anything with access to that folder. Data minimisation in the sense of Art. 5(1)(c) GDPR is about not collecting data in the first place — it is not device security, and it is not protection against malware that is already on the machine.

Why this matters more on a phone

On Android the browser holds more of daily life than the desktop does — banking apps, mail, portals, everything in one process, always signed in. At the same time the interface shows less: no permanent extension bar, no easy view of what is running.

The permission question is therefore worth more there, not less, while the tools to answer it are harder to reach. If you install an extension on a phone, reading its permission list once at install time is realistically the only check you will make.