Auditing Browser Extension Permissions: Spot Risky Add-ons

Here's a number that should make you pause the next time you click "Add to Chrome": a single browser extension with the right permissions can read every keystroke you type, every password you enter, and every page you visit, then quietly ship that data to a server you've never heard of. Security researchers have repeatedly found extensions with tens of millions of installs doing exactly this after being sold to shady buyers or hijacked through compromised developer accounts. The average power user runs somewhere between 8 and 15 extensions, and most of them were installed once and forgotten.

The uncomfortable truth is that extensions are the least-audited software most of us run daily. We scrutinize the apps we install on our phones, we hesitate before granting camera access, but we hand a "Read and change all your data on all websites" prompt a casual click because the extension promised to save us three seconds on a task. That permission is functionally a keylogger license.

This guide walks you through a proper browser extension permissions audit: how to read what an extension can actually do, how to spot the red flags that predict data theft, and a repeatable process you can run every quarter. We'll use real permission strings, a worked example with numbers, and a comparison of the auditing tools worth your time.

Key Takeaways

• Permissions are the whole game. An extension can only do what its manifest declares, so learning to read permission strings tells you 80% of the risk story.
• "Read and change all your data on all websites" is the single riskiest grant. Reserve it only for tools you fully trust and actively need.
• Ownership changes are the top threat vector. A benign extension can turn malicious overnight when it's sold or its developer account is phished.
• Run a full audit quarterly and remove anything you haven't used in 90 days. Dormant extensions are pure liability.
• Cross-check publisher reputation, update history, and requested scope before trusting any add-on with broad access.

Why browser extension permissions deserve a real audit

Extensions run inside your browser with a level of access that native apps envy. A well-scoped extension only touches what it needs. A poorly-scoped one, or a malicious one, sits between you and every website you load.

Three things make this dangerous:

• Extensions update silently. Version 2.4 might be a clean password helper. Version 2.5, pushed automatically, might exfiltrate form data. You never clicked anything.
• Extensions get sold. There's an active market where developers sell popular extensions to buyers who monetize the install base with ad injection, affiliate hijacking, or outright data theft.
• Permissions are broad by default. Many developers request "all sites" access when they only need one, because it's easier than configuring per-site permissions.

If you already take software supply-chain hygiene seriously, this is the same discipline applied to your browser. The habits overlap heavily with vetting open-source software supply chains before you install, where a single compromised dependency can poison an entire project.

How to read browser extension permissions like a pro

Every Chromium and Firefox extension ships a manifest.json file that declares its permissions. When you view an extension's details, the browser translates those raw strings into plain-English warnings. Learning both layers is the difference between guessing and knowing.

The permission strings that matter most

• "<all_urls>" or "host_permissions": ["*://*/*"] — access to every site you visit. This is the big one. It means the extension can read and modify content on any page, including banking and email.
• "tabs" — read the URL, title, and favicon of every tab. Useful for tab managers, dangerous for tracking your browsing.
• "webRequest" and "webRequestBlocking" — intercept and modify network traffic. Legitimate for ad blockers, a serious liability elsewhere.
• "cookies" — read and write cookies, which can include session tokens that let an attacker impersonate you.
• "history" — read your entire browsing history.
• "clipboardRead" — read whatever you copy, including passwords copied from a manager.
• "nativeMessaging" — communicate with programs installed on your computer outside the browser sandbox.

The plain-English warnings, decoded

When the install prompt says "Read and change all your data on all websites," that maps to <all_urls> host access plus a content script. When it says "Read your browsing history," that's the history permission. Match the friendly warning back to the raw permission and ask one question: does this tool's core function actually require this?

A grammar checker needs to read text on pages, so broad host access is defensible. A screenshot tool that only captures the visible tab does not need to read all your data on all websites, and if it asks for that, treat it as a red flag.

A step-by-step browser extension permissions audit

Here's the process I run on every machine I set up, and quarterly after that. It takes about 20 minutes for a typical extension list.

Step 1: Inventory everything you have installed

1. In Chrome or Edge, type chrome://extensions in the address bar and press Enter.
2. In Firefox, go to about:addons and click Extensions.
3. Enable Developer mode (top-right toggle in Chrome) so you can see extension IDs and load-unpacked details.
4. Write down or export the full list. Most people are surprised to find 3 or 4 extensions they don't even remember installing.

Step 2: Inspect permissions for each extension

1. Click Details on an extension.
2. Scroll to Permissions and Site access.
3. For anything showing "On all sites," ask whether it truly needs that. If the extension supports "On specific sites," switch it and see if the feature still works.
4. Note the extension's ID (a long string of letters). You'll use it to look up the source.

Step 3: Check the publisher and update history

1. Open the extension's Chrome Web Store or Firefox Add-ons listing.
2. Check the developer name, website, and support contact. Anonymous or mismatched publishers are a warning sign.
3. Look at the last-updated date. An extension untouched for two years with broad permissions is stale and risky.
4. Read the recent reviews, sorted by newest. A wave of complaints about ads, redirects, or "it changed after an update" is the ownership-transfer signature.

Step 4: Cross-reference the risk

1. Search the extension name plus "malware" or "acquired" or "sold." Community forums and security blogs surface incidents fast.
2. For high-risk extensions, look up the ID on a reputation service (covered below).

Step 5: Decide, remove, and lock down

1. Remove anything you haven't used in 90 days. Full stop.
2. Downgrade permissions where possible from "all sites" to "specific sites."
3. Set remaining broad-access extensions to run "on click" so they only activate when you invoke them.
4. Enable automatic updates only from trusted stores, and disable sideloaded extensions unless you built them yourself.

A worked example: auditing a real 11-extension profile

Let me make this concrete. On a client machine I audited recently, the browser had 11 extensions. Here's how the numbers broke down.

Of the 11, 7 requested "read and change all your data on all websites." When I mapped each one to its actual function:

• 4 genuinely needed it (a password manager, an ad blocker, a grammar tool, and a translation helper).
• 2 did not (a coupon finder and a "PDF converter" that redirected downloads through its own server).
• 1 was orphaned — a screen-recorder installed 14 months earlier, last updated 19 months ago, with an anonymous publisher and a support link that 404'd.

The remaining 4 extensions had narrow permissions and were fine. The action plan wrote itself:

• Removed the coupon finder and the fake PDF converter outright. Both were classic monetized-install-base candidates.
• Removed the orphaned screen recorder.
• Switched the translation helper from "all sites" to "on click."

Before: 11 extensions, 7 with total-access permissions, 3 clear liabilities. After: 8 extensions, 4 with broad access (all trusted and needed), one of which now runs on-click only. That's a roughly 43% reduction in high-risk grants in under 20 minutes. The client's browser also felt noticeably faster, because those three dead extensions had been injecting content scripts into every page load.

Best tools for a browser extension permissions audit

You can do a manual audit with nothing but the built-in extensions page, and for most people that's enough. But if you manage multiple machines or want ongoing monitoring, dedicated tools help. Here's how the main approaches compare.

Approach	Cost	Detects malicious code	Permission analysis	Ongoing monitoring	Best for
Built-in extensions page	Free	No	Manual	No	Everyone, as a baseline
Extension reputation checkers (CRXcavator-style)	Free	Partial (static)	Automated scoring	Limited	Power users vetting a specific add-on
Endpoint security suites	Paid	Yes (behavioral)	Basic	Yes	Business fleets
Enterprise browser management	Paid	Policy-based	Allowlist/blocklist	Yes	IT admins managing many users

For individuals, the winning combo is the built-in page plus a reputation checker for anything requesting broad access. For teams, enterprise browser policy that enforces an allowlist beats trying to educate every user one at a time. If you're building a broader security posture,

Cover image: Software value feedback loop by jakuza, licensed under BY-SA 2.0 via Openverse.