This release includes 1 breaking change for platform teams planning a safe upgrade.
✓ No known CVEs patched in this version
Affected surfaces
Summary
AI summaryRemoved the broad host permission; ATO now only uses the tabs permission.
Full changelog
What's Changed
Removed the <all_urls> host permission.
ATO no longer requests broad host access. The tabs permission alone covers everything it does — reading tab titles and URLs (including local file:// pages) to detect duplicates, search, and group tabs, plus loading favicons. This was verified empirically:
file://tabs are still detected as duplicates with no host permission and with "Allow access to file URLs" off.- Favicons render exactly as before.
- Closing tabs is unaffected.
Why it matters
- More private: the extension can no longer access page content on any site — it only reads tab metadata.
- Faster Chrome Web Store reviews: broad host permissions trigger an in-depth review; dropping it avoids that.
No functional changes to features — duplicate detection, search (fuzzy / exact / wildcard), domain groups, playing-media, and undo all work the same.
🤖 Generated with Claude Code
Breaking Changes
- Removed `host` permission; ATO now relies solely on the `tabs` permission.
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
About ATO
All releases →Beta — feedback welcome: [email protected]