Well, it's a great question, and I'm not satisfied with number of permissions as well, but they all necessary for nice ux.
- "storage" is for storing preferences
- "tabs" to listen for tab creation and activation events
- "webRequest" and "webRequestBlocking" are for saving and restoring request info such as referrer for example. And most of all to quickly get url of the created tab before it start load content to avoid duplication of requests.
- "history" is not necessary, but is used to remove extension holder page so it doesn't spam the history.
- is used with webRequest. I think this is what behind "access all data on all websites".

You may inspect the code itself at https://github.com/Reeywhaar/holdtab and if some permission is not necessary, I am all open for improvement.