It does allow permissions for specific site. I'm not sure how it works it might be needed so it can get the data from external sites.

you can allow access to finite set of websites in manifest.json while developing the chrome plugin.

You can always read the extension's source to see what exact data it's using and where it sends it to.

until it silently automatically updates

In my experience it won't work until you approve it, and even then the messaging Chrome uses here is really obtuse and makes it come off as malicious. A lot of people were initially put off by a recent Reddit Enhancement Suite update that asked the same thing, but all it was doing was trying to access full-sized images posted to the site from their native URLs so you didn't have to click into each one. Not sure if this is always 100% of the case regarding updates, though.

Extension updates only require approval if they add additional permissions. Of course you could always use: https://chrome.google.com/webstore/detail/nlldbplhbaopldicmc...

Ah, thanks.

mnicole, you do not need to approve extension updates unless they ask for more permissions.

In the ancestral thread, the assumption is those wildcard permissions were already granted.

Same reason I didn't install