=> "All it takes is specifying the <all_urls> permission in the extension’s manifest and adding some event listeners."

I guess android's "partial permission" is the right thing...