Required “all websites” is just Last.fm (scrobbling). “Access browser tabs” is only so Last.fm login can read the token out of that one auth tab and close it. Even just having the auth login page requires that exact notice to be on the extension page, but here is an exact rundown on the permissions
