Hacker News Reader

But WHY do they need that permission? They dont need it to implement the paste behavior. Looks super sus to me.

The extension needs to re-enable paste, which means it needs to possibly inject some JS into the page.

And they need a tab event to do that? Or could it just be done with a button on the toolbar.

One doesn't need broad security permissions.