IIRC extensions cannot access any URL that hasn't been specified in the manifests permission section. I think Firefox shows those URLs in the permission prompt. Those URLs can contain wildcards though and I even think there is a special value for all URLs but only few extensions should require that permission.
For extensions that modify page data, is that prompt still shown? My understanding was that once you have the 'modify page data' permission, you're no longer required to present URLs in the permission prompt at all — but I'd be thrilled to be wrong, if that's changed!
