This is surprisingly difficult to find information on.
By default, extensions are subject to a Content Security Policy (CSP) of:
"script-src 'self'; object-src 'self';"
In this case, the
self keyword refers to the extension package, and hence they can access any files which are included in the extension package itself. This strongly suggests that extensions cannot access any scripts which are hosted elsewhere, without the default CSP being overridden. Similarly, they can't run scripts using
eval without explicitly allowing it.
This does not actually require a permission though, so, in theory, given a self-contained JS flaw which can compromise the browser, an extension with no permissions could execute arbitrary code. This is of limited benefit - such a flaw would presumably work from a web page as well, so it doesn't meet your requirement.
Based on the repository of example webextensions, explicit permissions are not required to change the style of a specific site (e.g. the borderify example), the text content shown to the user (e.g. the Emoji Substitution example), or to copy data from pages to system clipboard (election-to-clipboard example) - the clipboard example does require the ability to "Access your data for all websites", which is implicitly granted by the
It is therefore possible to see some potential malicious actions, although it does appear possible for sites to block these (see the notes about addons.mozilla.org disallowing content scripts):
- Change the target for forms, so that data is sent to a third party upon submission (user activated submission - this is effectively just changing text)
- Modify the values shown on pages (e.g. change the target for online banking payments where a second factor isn't used to confirm this, add a "sorry your payment failed, please try again" message when the page returns a "payment complete" message)
- Combine with another application which can read clipboard content, and use the extension to get more useful data into the clipboard (e.g. copying values from logged in sites which are not otherwise visible)
All of these are dependent on the malicious actor being able to make reasonable guesses about what pages the users will visit, but if a large user base is assumed, this becomes a numbers game - someone will probably visit the target page eventually.