Why the addon needs permission to access browser tabs

Note

This help page only applies to Firefox users.

As of version 3.1.1, Firefox users now need to give the Custom Scrollbars add-on permission to access the browser tabs. In the interest of transparency, I'd like to offer an explanation of why this new permission is required.

UPDATE: As of version 3.1.2, this permission is no longer required for all users. Instead, it's an optional permission that you will only be prompted to provide to the add-on if your version of Firefox needs it.

The TL;DR of it is, nothing has really changed in how the add-on works and what information the add-on can access. This permission has been added mainly to make the add-on work properly on older versions of Firefox. The add-on still does not collect or save any information about what you are doing on Firefox.

When you load a website, the Custom Scrollbars add-on automatically adds a small piece of code to the website. These are called "content scripts" and they are lightweight pieces of code that the add-on uses to change the scrollbars on that specific website.

In order to make sure that the add-on has minimal impact on your browser's speed and performance, there's also some code always running in the background. This is called a "background script" and it's responsible for the heavy lifting, such as loading and saving your settings.

The content scripts communicate with the background script to get the information necessary to customize the scrollbar.

When a website loads, the content script will ask the background script for the scrollbar settings that you have set for that page. The background script will load this information from the browser storage, taking into account any Website Rules that you have set up in the add-on settings. For example, if you are on Website A and you have set Website A to display a different scrollbar from Website B, the background script will know this and give the content script the information for Website A.

This is usually only done when you first load a website, but the background script may tell the content script to ask for the scrollbar information again if you change your settings. That's how the add-on is able to now update the scrollbars on a page automatically instead of forcing you to refresh the page, as was previously the case.

In previous versions of the add-on, the content script would tell the background script what website it needs the information for. The message the content script sent to the background script would look something like this:

Message: "I need the scrollbar settings for example.com, please."

This worked well, but it created some issues for websites that have other websites embedded inside of them. For example, if a website has a social media feed embedded within it. To prevent information from being exposed to other websites, a website that is embedded within another website has no idea that it's within another website. This was creating some issues that users didn't like.

For example, assume you have set up the add-on settings so that Website A uses a red scrollbar and Website B uses a blue scrollbar. This works great when the websites are in different tabs, but it may create some outcomes that are not desired. If Website B is embedded within Website A, should the scrollbar be red or blue? A lot of users think that the scrollbar should be red, since Website B is being displayed within Website A and should therefore look the same.

The issue is that the content script running on Website B has no idea that it's being displayed inside of Website A, so it asks the background script for Website B's scrollbar settings.

To solve this issue, a new approach was taken in version 3.1.

The content script no longer needs to tell the background script what website it is on. Instead, it just tells the background script that it needs the appropriate scrollbar settings. Whenever the content scripts sends a message to the background script, Firefox includes some information in the message so that the background script is able to reply back to the content script. Among this information is the website address that the content script sent the message from and information about the tab the content script is in. Now, the message from the content script looks something like this:

Message: "I need the scrollbar settings, please."
From content script on: example.com
Within tab displaying: mozilla.org

Instead of depending on the content script to tell the background script what website settings to load, the background script now uses the information that Firefox includes in the message to determine this. Based on the user's settings (found under the Advanced Settings section of the Website Rules tab in the add-on options), the background script now load the scrollbar settings for the website on the tab, rather than the website that the content script is running on. In our previous example, the end result would be both Website A and Website B displaying red scrollbars.

Because the message from the content script still includes information about the specific website that the content script is on, it can still send the settings specific to that website instead, if the user settings are configured that way.

This approach works great... but not on older versions of Firefox.

On older versions of Firefox, information about the tab is not included in the message to the background script unless the add-on has permission to access the browser's tabs. This is why the add-on now requires permission to access your browser's tabs.