A computer-implemented method for managing permissions and capabilities for web applications and browser extensions includes receiving via a digital marketplace a request to provide a web application or a web browser extension to a computing device. Based on the request, the web application or the browser extension is provided to a web browser of the computing device. The method includes determining if the digital marketplace is a trusted location for the computing device based on a set of trust criteria, and including additional features of the web application or the browser extension if the digital marketplace is determined to be the trusted location.