Comment by aboodman

Perhaps you could use window.open() to get around needing chrome.windows.create, which would allow you to remove this permission.