Required permissions

Several permissions help the Web Extension SDK function correctly.
The manifest file templates in the Quickstart guide include the required permissions, and the following table lists the role each plays in the SDK:
Gives access to the Web Navigation API, which eyeo uses to block popups and apply document-level allowing filters.
Gives access to the Web Request API. Used to apply URL filters in MV2 and to report on URL filters in MV3. Also used to retrieve sitekeys for a site.
Allows blocking request based on URL filters in MV2. MV2 only.
Gives access to the Declarative Net Request API, which we use to apply URL filters in MV3. MV3 only.
Gives access to storage APIs, which eyeo uses to store downloaded subscriptions, user's custom filters, and so on.
Removes the default 5MB storage limit, which is insufficient for larger subscriptions.
Gives access to tab metadata, including the tab's URL, which is used to apply document-level allowing filters to the tab.
Used to apply content filters, including element hiding filters and snippet filters. MV3 only.
Allows the SDK to act on all websites. In MV2 manifests, this goes in permissions, but in MV3 manifests it goes in the host_permissions section.
For more on browser extension permissions and their impacts, view Google's documentation for Manifest V2 and Manifest V3 permissions.