Browser Extension Data Leaks: What to Check Before Installing

Browser extensions are the most quietly powerful software most of us run. A single extension can read every page you open, see every form you type into, and in many cases send that information to a server you have never heard of. In 2024 and 2025, security researchers repeatedly found popular extensions with millions of installs that had changed ownership, pushed updates that added tracking code, or were harvesting browsing data as a side business. Google has pulled dozens of extensions from the Chrome Web Store for exactly these reasons, and the pattern is not slowing down. The problem is that the install button gives you almost no information. You see a star rating, a user count, and a short description written by the developer. Nothing in that view tells you whether the "AI writing assistant" you just added is sending your draft emails, your internal documents, or your customer records to a third-party language model API. Yet that is precisely what a growing number of AI-branded extensions do, sometimes with terms of service that quietly allow the vendor to retain and reuse that data. This article is about the checks that actually matter before you install an extension that touches AI features. I will walk through what data these tools tend to collect, how to read the permissions and privacy policy without a law degree, a worked example showing how fast the exposure adds up, a comparison of how different kinds of AI extensions handle data, and a step-by-step audit you can run on the extensions already sitting in your browser. None of this requires special tools. It requires about thirty minutes and a willingness to say no to convenience.

Key Takeaways

An AI extension with "read and change data on all websites" permission can see everything you type into any web page, including passwords and draft messages.

"Processed locally" and "sent to our servers" are very different claims. Check the privacy policy for the words "third-party," "AI provider," and "model training."

Extensions change hands. A tool you trusted in 2023 may belong to a different company today, with different data practices.

Fewer permissions and a narrow host list are better than broad access, even when the broad version is more convenient.

Audit installed extensions every quarter, remove anything unused, and never install AI tools on a browser profile that holds work credentials.

What Data Do AI Browser Extensions Actually Collect?

Before you can check for leaks, you need to know what a leak looks like. For AI-branded extensions, the data falls into a few predictable categories, and each carries a different level of risk.

Page content. The text of the page you are reading, often including email bodies, dashboards, support tickets, and internal wikis. Summarizer and "chat with this page" tools need this, which is why they ask for broad access.
Form input. Anything you type into a text box, including prompts you write to the assistant and, in poorly built tools, the contents of login and payment fields.
Selected text. Highlighted passages sent for rewriting, translation, or explanation. This is often the most sensitive data because people highlight exactly what matters to them.
Browsing metadata. URLs visited, timestamps, referrers, and device identifiers. Even without page content, a list of URLs can reveal medical research, job searches, or legal troubles.
Account identifiers. Email addresses, Google account IDs, or license keys that link your activity to a profile on the vendor's side.

Not every extension collects all of these, and collecting them is not automatically malicious. The question is whether the collection matches what the tool needs to do its job, and whether the vendor is honest about where the data goes.

Local processing versus cloud processing

Some AI extensions run small models directly in the browser, typically using WebAssembly or WebGPU. Others forward your text to a cloud API such as OpenAI, Anthropic, Google, or a smaller provider. The difference matters enormously. A local model keeps the text on your machine, while a cloud model sends it across the internet, through the vendor's servers, and often onward to a model provider. Each hop is a place where logs can be kept, where a breach can happen, and where a policy can change later.

How Do You Read Extension Permissions Without Getting Lost?

Chrome and Edge show permissions in a warning dialog at install time, and you can see the full list later on the extension's details page at chrome://extensions. The permissions that matter most for AI tools are short, but the wording is easy to skim past.

"Read and change all your data on all websites." This is the broadest grant. It means the extension can read and modify any page you visit, including banking sites and webmail. Summarizers often request it, but ask whether you really need it on every site.
"Read and change your data on [specific sites]." Much safer. A tool that only works on Google Docs should only ask for docs.google.com.
"Read your browsing history." Lets the extension see every URL you visit, which is a surveillance-grade capability for most AI tools.
"Display notifications," "storage," "tabs." Usually low-risk on their own, but "tabs" combined with broad host access lets an extension track everything you open.
"Native messaging." Allows the extension to talk to programs installed on your computer. Legitimate for password managers, but worth questioning for an AI writing tool.

For a deeper breakdown of which permission combinations to worry about, see our guide to Browser Extension Permissions Explained: Which Ones Should Worry You in 2026. The short version is that the combination of broad host access plus any network capability is the one to watch.

Reading the privacy policy with a search box

Most privacy policies are long, but you rarely need all of them. Open the policy, press Ctrl+F (or Cmd+F), and search for these terms:

"third party" or "third-party", to find who receives your data.
"train" or "training", to see whether your content is used to improve models.
"retain" or "retention", to find how long data is kept, and whether a number is given.
"sell" or "share", to catch commercial sharing.
"anonymized" or "aggregated", and then check whether they define the terms. Vague anonymization claims are common and often weak.
"change" or "update", to see whether the vendor reserves the right to alter the policy without notice.

If a policy says prompts may be used "to improve our services" with no opt-out, assume your content is training data. If it names an AI provider as a sub-processor, your text reaches that company's systems too, and you should check that provider's policy as well.

A Worked Example: How Exposure Adds Up

Consider a mid-sized marketing manager, Dana, who works in Chrome with a single profile. Over a normal week she has 47 saved logins across 12 work services, including her CRM, email, analytics, and a shared finance spreadsheet. She installs three AI extensions in one afternoon: a summarizer, a grammar assistant, and an "AI reply" tool for Gmail.

Here is what each one can see, based on the permissions they request:

Summarizer: read and change data on all websites. It can read the CRM dashboard, the finance spreadsheet, and any login form on the 12 services. Its privacy policy lists two AI providers as sub-processors.
Grammar assistant: read and change data on all websites, plus clipboard access. It sees every text field, including password fields if the developer did not filter them out.
Gmail AI reply: limited to mail.google.com. Lower exposure, but it still reads every email in her inbox, including attachments previews.

Now multiply. Dana sends roughly 60 emails a day and types about 200 lines of text into web forms and documents. The grammar assistant alone touches every one of those characters. If it forwards even the text of a single field per session to its cloud API, a month of use puts several thousand internal passages on a third-party server. None of that required a breach. It only required a permissions dialog that Dana clicked through in four seconds.

The fix is not to ban AI tools. It is to run the checks in the next section, reduce each extension to the sites it genuinely needs, and move sensitive work into a separate browser profile. Dana ended up keeping the Gmail tool, restricting the grammar assistant to docs.google.com, and removing the summarizer entirely after finding its sub-processors were not listed anywhere in its policy.

How Do Common AI Extension Types Compare on Data Handling?

Not all AI extensions carry equal risk. The category a tool falls into is a useful first filter, because it tells you what it needs to function and therefore what it is likely to collect.

Extension type	Typical permissions	Where data goes	Training use risk	Retention clarity	Overall risk
Local-only model tools	Narrow or storage only	Stays on device	Low	Usually stated clearly	Low
Single-site AI assistants (e.g., Gmail, Notion)	Limited to one domain	Vendor servers, then model provider	Medium, depends on policy	Varies	Medium
General page summarizers	All websites, tabs	Cloud API, often multiple sub-processors	Medium to high	Often vague	High
Grammar and rewrite assistants	All websites, clipboard	Cloud API, sometimes unnamed	High	Often vague	High
Free "AI" tools funded by ads or data	All websites, history	Unknown or ad networks	High	Rarely stated	Very high

The pattern here is consistent: the more a tool needs to see, the more it asks for, and the less likely it is to be specific about where that data travels. Free tools with no clear revenue model deserve the most suspicion, because the product is often the data.

When a paid tool is actually the safer choice

People often assume free means riskier, and that is usually true, but not always. A paid tool with a clear subscription, a named data processor, and a contractual commitment not to train on your data can be safer than a free tool whose business model depends on your browsing. Price is a weak signal. Revenue model and policy specificity are strong ones.