Not a vulnerabilityNothing is bypassed: the browser grants exactly what the package declares. The objection is to the distance between that declaration and the function it was installed for.
What it is
An extension declares in its package which hosts it may read and change and which interfaces it may use. That declaration is what the browser enforces; the description in the listing is what the person reads. Where the declaration covers every host, or browsing history, or the contents of all pages, while the described function operates on a named handful of sites, the extension can read everything the person does in the browser, including what sits behind a login, because it runs inside the session.
Why it is a separate entry
An extension sits where no website reaches: after decryption, inside the account, on every tab. Access granted once persists silently across updates, and an extension can change owner without asking again. The person granted it for a function and cannot see what is read, because reading leaves no trace.
How it arises
a broad host pattern declared during development and never narrowed
one permission set covering several features, including ones this person never uses
a bundled library requiring a permission the extension itself does not need
an extension sold or transferred, keeping the permissions it already had
Not to be confused with
A page reading device characteristics is Device fingerprinting. A component inside an application that collects on its own account is Bundled component collection, which is established from observed traffic. This entry is about declared access, which exists whether or not anything has been sent yet.
How to establish it
The permission declaration in the published package covers hosts beyond those the listing describes the function as operating on: a pattern matching every host, or access to browsing history or to the contents of all pages, set against a description naming a bounded set. Both documents belong to the publisher; the researcher only does the set comparison.
method static-sourceQoD 90
Requirements on the measurement
read the declaration from the published package, not from a repository that may differ from what is shipped
record the version, the date, and the listing text of the same date
record permissions requested at runtime separately from those declared at install
check whether the publisher offers a narrower variant that the person could have installed instead
What would refute it
by handThe described function does operate on every site.finding falls
by handThe broad access is requested at runtime, when the person uses the extension on a site, and can be refused per site.finding falls
by handThe listing describes the broader function plainly, on the screen where the person installs it.weakens
by handThe declaration is broad and the shipped code demonstrably operates on the named hosts only.The access still exists and survives every update. The finding is about what is granted, and it is worth saying that the current release does not use it.weakens
Where this plugs into existing processes
The one question that surfaces itWhich sites can this extension read, and which sites does it say it works on?
In a DPIA, verify this
Verify the permission declaration of the shipped package against the described function before approving an extension for managed devices.
As a procurement clause
Extensions on managed devices declare host access limited to the sites the function operates on, checked again per version.
With a complaint, hand over
The declaration from the published package, the listing text of the same date, and the version number of both.
Reproduction
METHOD.md · by hand · no dedicated reproduction exists yet; follow the general method and the indicator above
Legal framing
eu-gdpr-5-1-c
eu-gdpr-25
nl-tw-11-7a
Objections, and the answer
“The browser shows the permissions at install.”
Once, in a sentence, next to a description that says something else. The comparison between those two is exactly the finding.
“We do not use the access we have.”
Access is what can be checked; use is not, and it changes with every release without anyone being asked again.
“Every extension asks for this.”
That is a statement about the ecosystem, not about necessity. A narrower pattern is available in the same interface and costs one line.
“The store reviewed and approved it.”
A review checks the package against the store's rules. It does not establish that the access is necessary for the function the person installed it for.
What this does not establish
harm; the catalogue standardises a finding so it can be referred to, it does not weigh it
severity; there is no score here, by design. Weighing belongs to whoever applies the entry to a concrete case
unlawfulness; that is for a supervisory authority or a court
intent; a fault is usually a build decision, not a plan
absence: not finding it in one capture is not evidence that it is not there
DPE Catalogue. DPE-2026-0042: Extension permissions beyond its function. Schema 2.0, entry status active. Retrieved from https://totaledigitalewaarborging.nl/register/DPE-2026-0042
Measurement
When you publish a finding, cite the method version alongside the entry: “DPE-2026-0042, established under DPE Measurement Method 1.0”
Identifiers are permanent and are never
reused. An entry that is deprecated keeps its number and its address, with the reason attached, because
references to it exist elsewhere.