Tabs API is usable without tabs permission.

chrome/common/extensions/permissions/permission_set.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/common/extensions/permissions/permission_set.h"
 
 #include <algorithm>
 #include <iterator>
 #include <string>
 
@@ skipping 39 matching lines @@
   "test",
   "types"
 };
 const size_t kNumNonPermissionModuleNames =
     arraysize(kNonPermissionModuleNames);
 
 // Names of functions (within modules requiring permissions) that can be used
 // without asking for the module permission. In other words, functions you can
 // use with no permissions specified.
 const char* kNonPermissionFunctionNames[] = {
   "management.getPermissionWarningsByManifest",

[Matt Tytel, 2012/08/06 18:45:23]

Ignorant Drive-by comment: Should executeScript should require permission since
they'll have access to the tab data? Or is that covered in the "http://*/*"
permissions?

Maybe insertCSS too for tab editing reasons.

+  "tabs.captureVisibleTab",
+  "tabs.connect",
   "tabs.create",
+  "tabs.detectLanguage",
+  "tabs.executeScript",
+  "tabs.get",
+  "tabs.getCurrent",
+  "tabs.getSelected",
+  "tabs.highlight",
+  "tabs.insertCSS",
+  "tabs.move",
+  "tabs.onActivated",
+  "tabs.onActiveChanged",
+  "tabs.onAttached",
+  "tabs.onCreated",
+  "tabs.onDetached",
+  "tabs.onHighlighted",
+  "tabs.onMoved",
+  "tabs.onSelectionChanged",
+  "tabs.onUpdated",
   "tabs.onRemoved",
+  "tabs.query",
+  "tabs.reload",
   "tabs.remove",
+  "tabs.sendMessage",
   "tabs.update",
 };
 const size_t kNumNonPermissionFunctionNames =
     arraysize(kNonPermissionFunctionNames);
 
 void AddPatternsAndRemovePaths(const URLPatternSet& set, URLPatternSet* out) {
   DCHECK(out);
   for (URLPatternSet::const_iterator i = set.begin(); i != set.end(); ++i) {
     URLPattern p = *i;
     p.SetPath("/*");
@@ skipping 517 matching lines @@
   std::set<std::string> new_hosts_only;
 
   std::set_difference(new_hosts_set.begin(), new_hosts_set.end(),
                       old_hosts_set.begin(), old_hosts_set.end(),
                       std::inserter(new_hosts_only, new_hosts_only.begin()));
 
   return !new_hosts_only.empty();
 }
 
 }  // namespace extensions