Content Scripts vs. New Tab Extensions: Why the Permission Difference Matters

There are two kinds of browser extensions: the kind that run on every page you visit, and the kind that run only when you open a new tab.

This distinction matters for privacy, performance, and permissions. Most users don't think about it.

Content Scripts: Running on Every Page

Extensions that modify web pages use "content scripts" — JavaScript that runs inside every page you visit (or every page matching a pattern). Examples:

• uBlock Origin: runs on every page to block network requests and hide elements
• Password managers: run on every page to detect login forms
• Grammar checkers: run on every page to read and analyze text
• Dark mode extensions: run on every page to modify CSS

These extensions need <all_urls> permission (or similar) because they need to run on every site. That permission is the single most powerful thing an extension can have — it gives the extension complete read/write access to everything you view in your browser.

This is why the "open source test" matters most for content script extensions. A closed-source extension with <all_urls> could, in principle, read every form you fill out, every URL you visit, every password you type. Most don't. But you can only verify that if the code is auditable.

New Tab Extensions: Running Only on New Tabs

New tab extensions replace the new tab page. They run only when you open a new tab — not on any other page you visit.

These extensions typically have:

• tabs permission (to replace the new tab page)
• Optionally location (if they show weather based on your location)
• No <all_urls> permission

Weather & Clock Dashboard has this structure: it replaces your new tab with weather and clocks. Its permissions are tabs and optional location. It doesn't run on any page you browse to.

The security model is completely different from a content script extension. If Weather & Clock Dashboard had a security bug or malicious code, it could only affect what happens on your new tab — not your banking session, not your email, not any page you visit.

Why This Matters for Trust Decisions

When deciding whether to install an extension:

High scrutiny (content scripts, <all_urls> permission):

• Is it open source?
• Is it actively maintained?
• Does it have a history of trustworthy behavior?
• Is the developer reputable?

Lower scrutiny (new tab only, minimal permissions):

• Does it do what I want?
• Is it open source? (still good practice)
• Is the permissions list consistent with what it claims to do?

You can check any extension's permissions in Firefox: about:addons → click extension → "Permissions" tab. This shows exactly what the extension can access.

The Practical Recommendation

Minimize content script extensions to those you actively need and trust. Maximize new tab and toolbar extensions (like bookmarks, color pickers, new tab replacements) — their attack surface is limited by design.

For content script extensions you rely on (password manager, ad blocker): prefer open source with active audits and a trustworthy organization behind them.