The current 0.3.1 release candidate uses six required permissions, one optional clipboard permission, and optional HTTP(S) host access requested at the point of need.
activeTabRequired
Use the current page after you invoke ImageSave
Gives temporary access to the active tab after an extension action, such as opening ImageSave or choosing its command. It is not a persistent all-sites grant.
contextMenusRequired
Add the right-click save action
Creates ImageSave's context-menu entry so you can start from the image or page you are already using.
downloadsRequired
Save the file through Chrome
Hands the chosen Original or generated output to Chrome's Downloads system, including safe filenames, Downloads-relative folders, and Save As where supported.
offscreenRequired
Run bounded browser image work outside the popup
Lets ImageSave use an offscreen extension document for supported decoding, conversion, preview preparation, clipboard handoff, and local ZIP work when a visible popup cannot safely host it.
scriptingRequired
Inspect the page only when requested
Injects the bounded scanner or picker into an eligible page after you invoke ImageSave. The extension does not install a persistent content script.
storageRequired
Keep settings and reconcile current work
Stores preferences and recipes locally, and uses session storage for current jobs, scans, permission leases, selected targets, and bounded receipts.
clipboardWriteOptional
Copy a generated PNG when you ask
Requested only when you choose Copy PNG. Denying it does not remove the ordinary download path.
http://*/* and https://*/*Optional host access
Read one selected image host when conversion requires it
ImageSave asks for the exact origin at the moment of need. Temporary access is removed after dependent work. There is no install-time persistent all-sites host grant.
What ImageSave does not request
The current candidate does not request identity, history, cookies, geolocation, notifications, bookmarks, native messaging, or a persistent install-time host grant. It contains no remote code.
