Browser extensions run with far more access to your browsing than most people realize — a malicious or poorly maintained one can read everything you type and see every page you visit. Extension stores catch a lot of bad actors, but not all of them, and a legitimate extension can also turn harmful after being sold to a new owner. Here's how to actually vet one.
Why extensions are riskier than regular apps
To do their job, many extensions need broad permissions — reading and changing content on every page you visit, for instance, is a normal requirement for an ad blocker or password manager. That same permission level, in the wrong hands, can log every page you visit, capture form data, or inject unwanted content. Because extensions often auto-update silently, an extension that was safe when you installed it can change behavior later without you reinstalling anything.
Before installing: what to actually check
- Read the requested permissions carefully and ask whether they match what the extension actually claims to do. A screenshot-and-annotate tool needing access to "read and change all your data on all websites" is expected; a simple calculator or unit-converter extension needing that same permission is a red flag.
- Check the developer. An extension published by a company you recognize, or with a linked, working website and privacy policy, is a better sign than an anonymous developer account with no other history.
- Look at install count and review recency, not just star rating. A high rating built from reviews years ago tells you less than a mix of recent reviews, since ownership and behavior can change over time.
- Search the extension's name plus "malware" or "review" before installing anything that will have broad page access — security researchers and tech outlets frequently flag problematic extensions publicly.
- Prefer extensions with fewer, more specific permissions over ones that request broad access "just in case." A well-scoped extension only asks for what its actual function requires.
Warning signs an installed extension may have gone bad
- A sudden update that adds new, broader permissions that weren't part of the original install — most browsers will flag this and ask you to review the new permissions before they take effect.
- Unexpected ads, redirects, or search engine changes appearing in your browser that weren't there before.
- The extension changing ownership, sometimes announced in a changelog or release notes, sometimes not — a known pattern is small, popular extensions being sold to third parties who then monetize the user base through ad injection or data collection.
- Noticeably slower browsing or the browser using more memory than usual, which can indicate an extension doing more in the background than it should.
How to audit what you already have installed
Open your browser's extension management page (in Chrome: chrome://extensions, in Firefox: about:addons) and review every extension currently installed, including ones you forgot about. For each one, ask: do I still use this, and do its permissions still make sense for what it does? Remove anything you don't actively use — an unused extension is unnecessary risk with zero benefit, since it still runs and holds its permissions even when you're not actively interacting with it.
A safer default habit
- Install extensions only from your browser's official store, not from a direct download link on a random website.
- Keep the number of installed extensions to what you actually use regularly.
- Review your installed list every few months, the same way you'd review app permissions on your phone (see our guide on managing app permissions).
- Pay attention to permission-change notifications rather than dismissing them automatically.
Quick extension safety checklist
- Check that requested permissions match the extension's actual stated purpose.
- Verify the developer has a real identity and, ideally, other reviewed products.
- Check recent reviews, not just overall star rating.
- Review your full installed list periodically and remove anything unused.
- Pay attention when a permission-change prompt appears after an update.