A bookmarking extension can use the activeTab permission, which gives them access only when the user clicks on the extension button and only to the current tab: https://developer.mozilla.org/en-US/docs/Mozilla/Add-ons/Web...

That's a great feature. Maybe not something people would want on a personal shopper extension though, which is another type of extension that might have done the sraping. It's more convenient to just have a price alert activate when I look at an item on Amazon than having to push a button every time.

Technically you can do that just with the webNavigation (allows you to see the URLs loaded) and the notifications (to alert the user).

This shouldn’t require arbitrary network access, though. You can read the content of pages and have access to browsing history locally.

Right, if someone is using Facebook Messenger in a browser, the message history could be scraped.