Tabs API is usable without tabs permission.

chrome/browser/extensions/event_router.h

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef CHROME_BROWSER_EXTENSIONS_EVENT_ROUTER_H_
 #define CHROME_BROWSER_EXTENSIONS_EVENT_ROUTER_H_
 
 #include <map>
 #include <set>
 #include <string>
@@ skipping 50 matching lines @@
   // Note that multiple extensions can share a process due to process
   // collapsing. Also, a single extension can have 2 processes if it is a split
   // mode extension.
   void AddEventListener(const std::string& event_name,
                         content::RenderProcessHost* process,
                         const std::string& extension_id);
   void RemoveEventListener(const std::string& event_name,
                            content::RenderProcessHost* process,
                            const std::string& extension_id);
 
+  EventListenerMap& listeners() { return listeners_; }
+
   // Add or remove the extension as having a lazy background page that listens
   // to the event. The difference from the above methods is that these will be
   // remembered even after the process goes away. We use this list to decide
   // which extension pages to load when dispatching an event.
   void AddLazyEventListener(const std::string& event_name,
                             const std::string& extension_id);
   void RemoveLazyEventListener(const std::string& event_name,
                                const std::string& extension_id);
 
   // If |add_lazy_listener| is true also add the lazy version of this listener.
@@ skipping 184 matching lines @@
         Profile* restrict_to_profile,
         EventRouter::UserGestureState user_gesture,
         const EventFilteringInfo& info);
 
   ~Event();
 };
 
 }  // namespace extensions
 
 #endif  // CHROME_BROWSER_EXTENSIONS_EVENT_ROUTER_H_