Great question—you’re absolutely correct that the webNavigation permission’s broad scope triggers that intimidating "read browsing history" prompt, even when you’re only targeting specific domains via matches. The good news is there are several straightforward alternatives that skip this permission entirely, tailored to different use cases:

1. Use Content Scripts (Simplest Approach) #

Content scripts are the most direct solution here. They’re designed to run automatically on pages matching your matches pattern, and they don’t require any extra permissions beyond what’s implied by the matches rule.

Add this to your manifest.json (adjust matches and js paths to your needs):

{
  "manifest_version": 3,
  "name": "Your Extension Name",
  "version": "1.0",
  "content_scripts": [
    {
      "matches": ["https://your-target-domain.com/*"],
      "js": ["content-script.js"],
      "run_at": "document_start" // Optional: Controls when the script loads
    }
  ]
}

Your content-script.js will execute automatically on every page matching the matches pattern. No webNavigation permission needed, no browsing history prompt—Chrome only tells users the extension can access data on your target domain, which is accurate.

2. Use the Declarative Content API (For Conditional Triggers) #

If you need to trigger actions (like showing your extension’s icon or injecting scripts) only when specific page conditions are met (beyond just URL matching), use the declarativeContent API. This permission is far more restricted than webNavigation and doesn’t trigger the browsing history prompt.

First, update your manifest.json:

{
  "manifest_version": 3,
  "name": "Your Extension Name",
  "version": "1.0",
  "permissions": ["declarativeContent"],
  "background": {
    "service_worker": "background.js"
  }
}

Then in background.js, register rules to trigger actions only on your target domain:

chrome.runtime.onInstalled.addListener(() => {
  // Clear existing rules first
  chrome.declarativeContent.onPageChanged.removeRules(undefined, () => {
    const targetDomainRule = {
      conditions: [
        new chrome.declarativeContent.PageStateMatcher({
          pageUrl: { hostEquals: "your-target-domain.com", schemes: ["https"] }
        })
      ],
      actions: [new chrome.declarativeContent.ShowPageAction()]
    };

    chrome.declarativeContent.onPageChanged.addRules([targetDomainRule]);
  });
});

If you need to inject a script when the icon is clicked, add the scripting permission to your manifest and use chrome.scripting.executeScript in your popup or background code—this still avoids the webNavigation permission.

3. Restrict Extension Action to Specific Domains #

If your extension’s code is triggered by user interaction (like clicking the extension icon), you can limit when the icon appears using show_matches in the action section of your manifest. This way, the icon only shows up on your target domains, and you don’t need to listen for navigation events.

Update your manifest.json:

{
  "manifest_version": 3,
  "name": "Your Extension Name",
  "version": "1.0",
  "action": {
    "default_popup": "popup.html",
    "show_matches": ["https://your-target-domain.com/*"]
  },
  "permissions": ["scripting"]
}

In your popup.js, you can inject scripts into the current page (only possible when the icon is visible, i.e., on your target domain) with:

document.getElementById("run-script").addEventListener("click", async () => {
  const [tab] = await chrome.tabs.query({ active: true, currentWindow: true });
  await chrome.scripting.executeScript({
    target: { tabId: tab.id },
    files: ["your-script.js"]
  });
});

Why webNavigation Triggers the Prompt #

The webNavigation permission grants access to all navigation events across every site, even if you filter them in your code. Chrome’s permission prompts reflect the maximum potential access of the permission, not your runtime filtering. The alternatives above use declarative, domain-restricted rules that Chrome recognizes as limited to your target sites, so the prompts are accurate and non-alarming.

内容的提问来源于stack exchange，提问作者user9154336