Tabs API is usable without tabs permission.

chrome/browser/extensions/event_router.cc

Index: chrome/browser/extensions/event_router.cc
diff --git a/chrome/browser/extensions/event_router.cc b/chrome/browser/extensions/event_router.cc
index 8be11a650290ffce2321c1ca1e03c98d52bab06b..325009f0a7193382206244f997414f348ab0fe8d 100644
--- a/chrome/browser/extensions/event_router.cc
+++ b/chrome/browser/extensions/event_router.cc
@@ -13,6 +13,7 @@
 #include "chrome/browser/extensions/api/web_request/web_request_api.h"
 #include "chrome/browser/extensions/extension_devtools_manager.h"
 #include "chrome/browser/extensions/extension_host.h"
+#include "chrome/browser/extensions/extension_tab_util.h"
 #include "chrome/browser/extensions/extension_process_manager.h"
 #include "chrome/browser/extensions/extension_processes_api.h"
 #include "chrome/browser/extensions/extension_processes_api_constants.h"
@@ -443,6 +444,11 @@ void EventRouter::DispatchEventToProcess(const std::string& extension_id,
     return;
   }
 
+  // If the "tabs" permission is not present, we need to strip the Tab argument
+  // of sensitive data.
+  ExtensionTabUtil::MaybeStripEventArgsOfSensitiveData(

[Aaron Boodman, 2012/08/30 05:45:48]

Can we go back to only adding it in the first place if needed?

[chebert, 2012/08/30 23:17:20]

Done.

+      event->event_name, extension, event_args);
+
   DispatchExtensionMessage(process, extension_id,
                            event->event_name, event_args,
                            event->event_url, event->user_gesture,
@@ -523,9 +529,10 @@ void EventRouter::DispatchPendingEvent(const linked_ptr<Event>& event,
     return;
 
   if (listeners_.HasProcessListener(host->render_process_host(),
-                                    host->extension()->id()))
+                                    host->extension()->id())) {
     DispatchEventToProcess(host->extension()->id(),
                            host->render_process_host(), event);
+  }
 }
 
 void EventRouter::Observe(int type,