From 2061e6224f53dfff08dc3117c860e6b9e4d658ee Mon Sep 17 00:00:00 2001
From: Devlin Cronin <rdevlin.cronin@chromium.org>
Date: Wed, 17 Sep 2025 16:43:14 -0700
Subject: [PATCH] [Extensions] Update debugger API entry in security FAQ

Bug: 40054742
Change-Id: I6e91b89e2b075eb16e8567b5c76ea8da3364fb30
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/6961403
Commit-Queue: Devlin Cronin <rdevlin.cronin@chromium.org>
Reviewed-by: Chris Thompson <cthomp@chromium.org>
Cr-Commit-Position: refs/heads/main@{#1516943}
---

diff --git a/extensions/docs/security_faq.md b/extensions/docs/security_faq.md
index ba9895d..11e9549f 100644
--- a/extensions/docs/security_faq.md
+++ b/extensions/docs/security_faq.md
@@ -421,10 +421,17 @@
 
 ### What privileges does the Debugger permission grant an extension? What privileges should it lack?
 
-The debugger permission should grant an extension the power to automate any
-website. This may extend to driving interactions with that site which are not
-possible using JavaScript on the site itself, but instead normally require
-user interaction with Chrome features.
+The debugger permission grants an extension with access to the Chrome DevTools
+Protocol, which is a powerful API surface that has many different capabilities.
+This allows an extension to automate or debug any website, and may extend to
+driving interactions with that site which are not possible using JavaScript on
+the site itself, but instead normally require user interaction with Chrome
+features.
+
+Through the use of certain methods in the Chrome DevTools Protocol, the
+debugger API *may* in some cases also sidestep other typical restrictions, such
+as host permissions or file access. This is the reason for the broad security
+warning associated with the debugger API.
 
 The debugger permission does not allow automating parts of the Chromium
 browser unrelated to websites. Automating WebUI or settings, installing