Tool guides · Published 2026-08-08 · Updated 2026-08-08 · 11 min read

Browser Permissions Explained for Job-Search Extensions

Quick answer

"Read and change all your data on the websites you visit" is Chrome's plain- English warning for broad host permissions: the extension can see and modify the content of pages you open. It describes what the extension is allowed to do, not what it does with the data — a sponsor checker that matches an employer name on your device and one that uploads every page you read can carry the identical warning. The way to tell them apart is the store listing's privacy disclosures plus Chrome's per-extension site access setting, which lets you downgrade most extensions to "on click" so they only run when you ask.

Key takeaways

• Permission warnings describe capability, not behaviour. Two extensions with

the same warning can be very different products.

• Host permissions are the ones that matter for job-search tools; API

permissions like storage are usually unremarkable.

• Chrome lets you set site access per extension to "on click", "on specific

sites", or "on all sites". Most job-search tools work fine on the first two.

• An extension that matches data on your device and one that sends pages to a

server are different privacy propositions at the same permission level.

• No permission list tells you whether an employer will sponsor a role. That

is a question for the official register and the employer.

Disclosure

This site is published by the team behind a UK sponsor-search tool, which is a browser extension. That means we have a commercial interest in the category discussed on this page. The guidance below is written to be applied to any extension, including ours, and every claim about how Chrome behaves can be checked against Google's own documentation.

What the warning actually means

Capability, not conduct

When you install an extension, Chrome shows a summary of the permissions it has requested. The most alarming-sounding line — "read and change all your data on the websites you visit" — is generated when an extension asks for broad host access, meaning access to page content across sites rather than a named list.

The important thing to understand is that this is a statement about permission, in the same way that a house key is a statement about access. It tells you the extension can read page content. It tells you nothing about whether it reads a single company name, the whole page, or every page you open, and nothing about where that data goes afterwards.

That gap is why the permission screen alone is a weak basis for a decision, and why "this extension asks for scary permissions" and "this extension is invasive" are not the same claim.

Why any page-reading tool needs it

A sponsor checker has to read the employer name from the job page you are looking at. There is no way to do that without access to the page content. The question worth asking is not "why does it need to read the page?" but "which pages, and what leaves the page?"

An extension scoped to a list of job boards and applicant tracking systems needs access to those hosts. An extension scoped to every site on the internet needs a reason, and "we might add support for more boards later" is a product roadmap, not a reason to hold the access today.

Host permissions versus API permissions

The two families

Extension permissions split into two useful categories:

Host permissions decide which sites the extension can read and change. These generate the loudest warnings and carry the most privacy weight.

API permissions decide which browser features the extension can use — storing data, opening tabs, injecting scripts, reading the clipboard, and so on. Some are routine; a few are worth a second look on a job-search tool.

A decoder for the common ones

The pattern to notice: the permissions that make a job-search tool work are host access to job sites, plus storage and scripting. Anything much beyond that is a question, not necessarily a problem.

The one that changes the picture

The distinction that tells you the most is between an extension that lists specific hosts and one that asks for all of them. Two checkers can offer the same feature list, and the one scoped to twenty job sites has taken on a fraction of the risk of the one scoped to the entire web. That difference is visible before you install, on the store listing, in about fifteen seconds.

Local matching versus cloud matching

Same permission, different products

Consider two sponsor checkers, both showing "read and change your data on linkedin.com".

Checker A ships a copy of the public register inside the extension and matches the employer name on your device. The page content never leaves your browser. Its network activity is periodic register updates.

Checker B sends the page — or the extracted employer name, or both — to a server for matching, scoring, or "AI analysis". The page content leaves your browser every time you use it.

Chrome shows the same warning for both, because Chrome is describing access to the page, not the destination of the data. Only the store listing's privacy section and the developer's own privacy policy distinguish them.

Why it matters for a job search

A job search is sensitive in an ordinary, non-dramatic way. The pages you look at reveal that you are looking, which employers you are considering, when you are doing it, and what you might be paid. Most people would not publish that, and it is reasonable to want it to stay on your machine.

Neither model is automatically wrong. Cloud processing buys features that local matching cannot deliver. But a tool that processes in the cloud cannot also claim your search stays private, and a claim of privacy is checkable against the disclosures.

The register is public either way

Worth stating plainly, because it cuts through a lot of marketing: the register of licensed sponsors is a public file published by the Home Office Source: GOV.UK — Register of licensed sponsors: workers. Nobody has privileged access to it. A tool that processes your pages remotely is not getting better register data by doing so — it is getting your pages. For the manual routes to the same answer, see our guide to checking an employer's sponsor licence for free.

What the store listing tells you

Where to look

Chrome Web Store listings carry a privacy section in which developers declare what data the extension collects and certify how it is used, alongside the permissions themselves. The Chrome Web Store's developer programme rules require those disclosures and limit how collected data may be used Source: Chrome Web Store developer documentation. Reading that section takes a minute and is more informative than the review score.

Four questions to answer before installing

1. Which hosts does it request? Named sites, or everything.
2. What does the privacy section declare? Personally identifiable

information, web history, and user activity are the categories that matter for a job-search tool.

1. Where does processing happen? The listing or the linked privacy policy

should say. If neither does, that silence is itself an answer.

1. Is there a working support route? A dead website and no contact address

on a tool handling your job search is a reason to pass.

Decoding the phrasing

Store copy uses similar-sounding phrases with different meanings:

None of these is disqualifying on its own. They are simply different products, and the words let you tell which one you are installing.

Reducing what you grant

Chrome's site access control

Installing an extension is not the end of the negotiation. Chrome exposes a per-extension site access setting, typically offering three levels: run only when you click the extension, run on specific sites you nominate, or run on all sites Source: Google Chrome Help.

For most job-search tools, "on click" or "on specific sites" is enough. A sponsor checker set to "on click" still checks the employer when you ask it to; what it loses is the ability to grade every card on a search results page automatically. That is a real trade-off, and it is yours to make rather than the developer's.

The practical setup

A configuration that keeps most of the value and most of the privacy:

1. Install the extension.
2. Open the extension's details from your browser's extensions page.
3. Set site access to the specific job boards and career sites you actually

use.

1. Add a host later if you start using a new board, rather than granting

everything up front.

1. Review the list once a quarter.

Optional permissions

Well-built extensions request the minimum at install and ask for additional host access only when you use a feature that needs it. If you are comparing two similar tools, the one that asks for less on day one and requests more in context is showing you how it thinks about your data.

What changed with Manifest V3

Chrome's current extension platform separates host permissions from API permissions in the extension manifest, runs background logic in service workers rather than persistent pages, and constrains the older request-blocking capabilities in favour of declarative rules Source: Chrome Extensions documentation.

For a reader deciding what to install, the practical effects are modest but real: permissions are declared more explicitly, and an extension cannot sit resident in the background in the way older ones could. It does not, however, prevent an extension from asking for broad host access and sending page content to a server. Platform rules constrain the mechanism; the disclosures and your site-access settings still do the work.

Auditing what you already run

The quarterly pass

1. Open your browser's extensions page and list everything with a job-search

purpose.

1. Remove anything you have not used in 30 days. Unused extensions keep their

permissions.

1. For the survivors, open the details and check site access is still as

narrow as you set it.

1. Re-read the store listing's privacy section. Disclosures change when

products change.

1. Check the last-updated date. A tool abandoned a year ago is a stale

dependency, not a stable one.

1. Uninstall anything you cannot describe in one sentence.

Signals worth acting on

• An update that broadens permissions without explaining why.
• A privacy policy that changes to add data sharing.
• A product that grows an account requirement it did not have before.
• Support channels going quiet.
• Claims that outrun what any tool can do — see our guide to

visa job scam warning signs for the patterns that show up in this category.

The one-sentence test

If you cannot state what an extension does in a single sentence, uninstall it. "It matches the employer on a job page against the sponsor register" is a sentence. "It helps with my job search" is not, and vague tools accumulate permissions for vague reasons.

What permissions cannot tell you

A permission list is a capability statement. It cannot tell you:

• Whether the developer honours their disclosures. Policy compliance is

enforced by the store, not visible in the manifest.

• How good the underlying data is. A checker with perfect privacy and a

stale register still gives wrong answers.

• Whether an employer will sponsor you. A sponsor licence is permission to

sponsor; it is not a promise to sponsor any role or any person, and no extension can see an employer's intentions.

• Whether a role meets the salary requirements for your situation. Tools

can compare an advertised figure against published floors, but the offer and the occupation decide the answer.

Our broader comparison of Chrome extensions for UK job seekers covers the tool categories themselves and where each one stops.

The bottom line

Permission warnings are a floor, not a verdict. Read them for scope — named sites or everything — then get the behaviour from the store listing's privacy disclosures and the developer's policy, and then narrow the grant yourself using Chrome's site access setting. Applied consistently, that three-step habit takes about two minutes per extension and separates a tool that reads a company name from one that reads your entire job search. It will not tell you which employers sponsor; the official GOV.UK register does that, free and without any extension at all. This page is information about software permissions, not immigration advice.

Sources

1. Chrome Extensions documentation — Chrome for Developers
2. Chrome Web Store developer documentation — Chrome for Developers
3. Google Chrome Help
4. Register of licensed sponsors: workers — GOV.UK
5. Information Commissioner's Office
6. Find an immigration adviser — GOV.UK

Frequently asked questions

What does "read and change all your data on the websites you visit" mean?

It means the extension has broad host permissions and can read and modify the content of pages you open. It describes capability, not what the extension actually does with what it reads.

Is that permission dangerous?

It is broad. Whether it is dangerous depends on what the extension does with the access, which is set out in the store listing's privacy disclosures and the developer's privacy policy rather than in the warning itself.

Why does a sponsor checker need to read job pages?

To find the employer name on the page you are viewing. Reading page content is the only way to do that. What varies between tools is which sites they read and whether that content leaves your device.

Can I stop an extension running on every site?

Yes. Chrome offers a per-extension site access setting with options to run only when clicked, only on sites you nominate, or on all sites. Narrowing it is usually the right default.

Will restricting site access break a job-search extension?

It changes behaviour rather than breaking it. Set to "on click", a checker runs when you invoke it, but automatic features such as grading every result on a search page will not run until you do.

How do I tell whether an extension processes data locally?

Read the privacy section of the store listing and the linked privacy policy. Local or on-device processing is usually stated explicitly, because it is a selling point. Silence on the question is not evidence of local processing.

Does "no data collected" mean nothing is read?

Not necessarily. Declarations often concern data collected and transmitted by the developer. An extension can read page content in order to work while collecting nothing, and the two statements are compatible.

Are extensions with lots of users safer?

User counts measure popularity, not data practice. A widely installed tool with broad permissions and vague disclosures is not safer than a small one with narrow permissions and clear ones.

What permissions should make me look twice on a job-search tool?

Clipboard reading, downloads, identity, cookies, and access to all sites when the tool only claims to support a handful of job boards. None is automatically wrong; each deserves a stated reason.

Does uninstalling an extension delete its data?

Data stored locally in your browser by the extension is removed with it. Data already sent to a developer's servers is governed by their privacy policy and your rights under UK data protection law, not by the uninstall button.

Should I pay for a sponsor checker?

Not for the register lookup itself — that data is public and free from GOV.UK. Paid tiers are only worth considering when they add something the raw register cannot give you, such as reading the advert or working out which salary floor applies to your circumstances.

Do these tools work on company career pages?

It depends on the extension's host permissions. A tool scoped to LinkedIn only will not run on an applicant tracking system, and the store listing's site list tells you before you install.

Can an extension tell me whether I will get sponsorship?

No. It can tell you whether an organisation appears on the public register. A licence is permission to sponsor, not a promise to sponsor a specific role or person, and the visa decision belongs to the Home Office.

Does this page give immigration advice?

No — it is information about browser permissions and how to read a store listing, and it is not immigration advice. Questions about visa routes, eligibility, or your own application belong with GOV.UK or a regulated adviser.

Sources