From a comment three days ago: > Right now I'm asking for "all permissions" for our extension as I need to inject a header in an HTTP response for CORS. So we're under auditing for every update.