Justification for the declared permissions

activeTab

To be able to change the filtering mode on the current website, including toggling off and on the content blocker.

alarms

To execute low-priority housekeeping tasks such as pruning least recently used cosmetic filters from session-based cache, or clearing expired cached data from subscribed remote filter lists.

declarativeNetRequest

To declaratively tell the browser which network requests to block, not block, redirect, or in some cases modify.

offscreen

An offscreen document is used as a replacement for dynamic import, which not possible inside a service worker. This ensures the service worker stays lean by not loading JS code which is used only intermittently as a result of the user opting in to create their own filters or to explicitly subscribe to filter lists hosted on remote servers.

The offscreen document is used to execute code which parse and compile the user's own filters or subscribed filter lists so as to keep the service worker as lean as possible when there is no need to parse and compile filters and/or filter lists.

The reason parameter used is "WORKERS" even though the offscreen document doesn't use worker -- I couldn't find a better matching reason. In effect, the offscreen document itself acts as a service worker spun by the actual extension's service worker when needed.

scripting

To be able to declaratively inject CSS/JS content scripts for better content filtering on various sites requiring more advanced content filtering than what the DNR API alone can provide.

storage

storage.local: To persist user settings and data across browser launches.

storage.session: To speed up service worker initialization time by persisting mutable data always required by the service worker.

unlimitedStorage

Since users can explicitly subscribe to filter lists hosted on remote servers, it is required to have enough storage so that the result of parsing/compiling these subscribed filter lists can be cached locally for efficiency purpose, to avoid having to fetch/parse/compile every time the user change the set of enabled filter lists.

userScripts

To allow user to create their own user custom filters, or to allow users to explicitly subscribe to filter lists hosted on remote servers. Custom filters and filter lists are compiled into dynamic DNR rules (network-based filters) and as declaratively injected user scripts (cosmetic- and scriptlet-based filters).

The scriptlet-based filters crafted by the user or imported from subscribed filter lists hosted on remote servers are always limited to a existing library of code snippets packaged in the extension's /js/resources/.

Official documentation is for scriptlets is under "Scriptlet injection" at: https://github.com/gorhill/uBlock/wiki/Static-filter-syntax#scriptlet-injection

Host permission <all_urls>

By default uBO Lite is meant to better filter content everywhere by default. The extension can still be used with reduced host permissions when the user chooses so.