虽然这个问题很老了，但我发现谷歌开发者网站提供了简单的方法来记住全局类型的权限.如果您想在任何可以添加 "permissions": ["<all_urls>"] 到清单的地方进行跨源 ajax 请求.或者，您可以使用此处中描述的匹配模式.

Although question is quite old, I found that google developer site provide easy way to remember global kind of permission. If you want to make cross origin ajax requests in any where you can add "permissions": ["<all_urls>"] to the manifest. Or else you can use matching patterns which are described in here.