Excessive permissions

Common reasons Google rejected this

• 01A permission is declared in manifest.json but never called in code.
• 02A broader permission is used when a narrower one would suffice (tabs instead of activeTab).
• 03Host permissions cover <all_urls> when only a few domains are needed.

How to fix it

• Remove any permission you don't actually use.
• Replace 'tabs' with 'activeTab' when you only need the current tab.
• Narrow host_permissions to specific origins like https://api.example.com/*.
• Move sometimes-used permissions to optional_permissions and request them at runtime.

ExtGuard scans for this automatically

Our scanner runs 5 checks that catch this violation before submission.