CrossposterExtension permissions
Right-click menucontextMenus
The extension's entry point: the Crosspost item in the menu you get when you right-click a post.
Local storagestorage, unlimitedStorage
Drafts, preferences, and the post you're crossposting are kept in your browser's local extension storage while you compose. Captured media – especially video – can exceed the default storage quota, which is what the "unlimited" part is for. Nothing leaves your device.
Tabs and tab groupstabs, tabGroups
Opens each destination platform's composer in its own tab, groups and labels those tabs
so you can review them together, and keeps them in sync with the platforms you've enabled
in Settings. Reading a tab's address to recognize a supported platform requires the
tabs permission.
The page you invoke it onactiveTab
Grants temporary access to the one page where you explicitly right-clicked Crosspost – the standard, minimal way for an extension to act on "this page, when asked".
Script injectionscripting
Registers the capture-and-compose script for each platform you enable in Settings, and unregisters it when you disable one. Only the extension's own bundled files are ever injected, and only on the supported platforms' sites.
Downloadsdownloads
The Download video feature saves a post's media through your browser's normal downloader.
ClipboardclipboardWrite
The sidebar's explicit "copy text" and "copy image" buttons. Write-only – the extension never reads your clipboard.
Notificationsnotifications
Tells you when your LinkedIn post is detected as published, so the crosspost session can move on to the next platform.
SidebarsidePanel / sidebar_action
The handoff sidebar that holds your text and media, ready to drag into a site's own composer.
Request observationwebRequest
Watches for one thing only: the completion of your own LinkedIn publish request, filtered to LinkedIn's publish endpoint, to advance the crosspost session. Observational only – nothing is modified, blocked, or recorded, and no other traffic is watched.
Site access
Crossposter asks for access to the supported platforms' sites – and nothing else. Those hosts fall into three groups:
- The platforms themselves (UpScrolled, X/Twitter, LinkedIn, Bluesky, Instagram, Threads, Facebook): capturing the post you right-click and pre-filling each site's own composer. The capture script for a platform only runs if you've enabled that platform in Settings.
- Their media CDNs (for example
*.twimg.com,*.licdn.com,*.cdninstagram.com,*.fbcdn.net,video.bsky.app): fetching a post's original image and video files so they can be re-uploaded as genuine files into the destination composer. - Their public post APIs (
cdn.syndication.twimg.com,public.api.bsky.app): resolving a post's direct video renditions without involving any third-party service.
What we hold ourselves to
- Nothing requested is unused. Removing any permission above would break a shipped feature, and an automated check keeps the permission list in sync with the supported platforms.
- The broadest grants are the narrowest in use.
tabs,webRequest, andunlimitedStorageeach exist for exactly one feature described above. - You can verify all of it. Crossposter is open source; the permission audit maps every entry to the code that uses it.