Why does the extension look like it needs broad permissions to a user's browser?
The FCM Extension has to pick from a pre-defined list of options, and we have to pick all websites because if we try to provide the Chromium extension framework with 2000+ URLs as part of its manifest, it will crash. We just enable all and then filter for only the 2000+ supported travel sites from within the application.
Why does the extension show "read and write" and "modify your browser history" permissions?
The extension needs "read and write" permissions as "read" is necessary in order to see the context that the user is entering (for example, in an origin or destination field), and "write" is necessary in order to show the notifications.
This is similar for "modify your browser history." The extension needs to know what URL the user is on, and that's the only permission that has been available. We don't use the "modify" part of this permission but there has only been one single permission to select.