1826442 - Feature Request - Enable allowlisting of domains per extension

Status: NEW

(WebExtensions :: Untriaged, enhancement, P3)

Description

[phastings]

Attachment: ext-permissions-chrome.jpg

User Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/111.0

Steps to reproduce:

As of Firefox 111.01, I cannot specify domains or websites that an extension is exclusively allowed to run on.

Actual results:

All extensions run globally across websites with the permissions you give them.

Expected results:

Allow extensions to only run on specific sites. This should prohibit an extension that is potentially malicious from accessing more than it is given access to.

A use case for this would be an extension that is meant for leisure sites like media (youtube for example) but this same extension not being loaded when you access your banking details or login to a payment portal (paypal for example).

This would be generally helpful.

Comment 1

[BugBot [:suhaib / :marco]]

The Bugbug bot thinks this bug should belong to the 'WebExtensions::Untriaged' component, and is moving the bug to that component. Please correct in case you think the bot is wrong.

Comment 2

[Tomislav Jovanovic :zombie]

We support this for Manifest V3 extensions: https://blog.mozilla.org/addons/2022/11/17/unified-extensions-button-and-how-to-handle-permissions-in-manifest-v3/

For MV2 extensions, they were primarily written with "required" permissions granted at install, and available from then on, so they may break if we invalidate that assumption. We're still haven't decided if we're able to implement this feature for MV2, and how exactly to minimize disruption.