-
Can I deny an addon certain permissions listed as “required”?
-
Can I deny it to phone home, as in block any custom outbound connection it tries to establish?
More toggle switches for things like that would be nice compared to “The developer says this extension doesn’t require data collection”
Usually those required permissions are directly derived from the APIs the extension uses, so you probably could but not without losing some functionality. For example, if you completely blocked network requests uBlock itself makes it would be unable to fetch the blocklists. I think auditing the code and disabling autoupdates if you’re concerned about the dev’s trustworthiness would be a better approach, but afaik it has a spotless track record
I should have used a better example than uBlock. Think of an addon that lets you change your browser’s locale. Those hardly ever need to be updated, yet I can’t find a way to keep them offline.
It’s not really about updates or checking for them. Any browser addon that is supposed to interact with all websites, no matter how minor, needs those permissions. It is basically a filter for when you visit a website, if an addon is allowed to “see” the page/traffic. Even for changing the locale, this is needed.
Addons that won’t need this (and typically don’t, and you should check) are for example those that change the layout of YouTube, or hide videos on there based on type (like shorts) or keywords. They only need access permission for YouTube.com (and other country variations like .fr or .de).