Browser Extension Audit: Find & Remove Risky Add-Ons

Most people install a browser extension, click "Add to Chrome," and never think about it again. That casual habit is exactly what attackers count on. Browser extensions run with deep access to everything you do online: they can read the pages you visit, modify what you see, capture form data, and in many cases read your clipboard. A single malicious or abandoned add-on can quietly sit in your browser for years while you assume it is harmless. The scale of the problem is hard to ignore. Security researchers have repeatedly documented cases where popular extensions with millions of installs were sold to new owners who then pushed malicious updates, a pattern often called "extension hijacking." Other campaigns have used copycat extensions with names nearly identical to legitimate tools, relying on users to click through without checking the publisher. In many of these incidents, the extensions had passed through the store's review process and stayed live for weeks before anyone noticed. This guide is a practical browser extension security audit. You will learn how to inventory what is installed, how to judge whether an add-on is risky, how to check permissions and publisher history, and how to remove what does not belong. We will walk through a real-world style example with numbers, compare tools that help with the audit, and finish with the questions people most often ask. Nothing here requires specialist knowledge, only about 30 to 45 minutes and a willingness to say no to tools you no longer need.

Key Takeaways

Extensions can read and change every page you visit, so treat each one as a privileged program, not a small widget.

Start with a full inventory across every browser profile, including Chrome, Edge, Firefox, and Brave, because each keeps its own list.

Check the permissions requested, especially "read and change all your data on all websites," and ask whether the tool actually needs it.

Look at the publisher, the last update date, the number of users, and whether ownership changed recently. Abandoned and recently sold extensions are high-risk.

Remove anything you do not use weekly, then rotate passwords for accounts you accessed through extensions that handled logins.

Repeat the audit quarterly, and treat every new install as a decision with a review date.

What Is a Browser Extension Security Audit?

A browser extension security audit is a structured review of every add-on installed in your browser. The goal is to answer three questions for each one: Do I still need it? Does it ask for more access than its job requires? Can I trust the people who publish and maintain it?

The audit covers four layers:

Inventory: the complete list of installed extensions, across every browser and profile.
Permissions: what each extension is allowed to see and do on websites.
Provenance: who published it, whether ownership changed, and how actively it is maintained.
Behavior: whether it makes unexpected network connections, injects scripts, or changes settings you did not authorize.

Most people only ever do the first step, if they do anything at all. The first two layers catch the majority of real problems, and that is where this walkthrough concentrates.

How Do You Find Every Extension Installed in Your Browser?

Your browser's extension list is the starting point, but many users discover they have far more extensions than they remember. Work through each browser you use, since each one keeps a separate inventory.

Step-by-step: building your inventory

Open your browser and type chrome://extensions in Chrome, edge://extensions in Edge, brave://extensions in Brave, or about:addons in Firefox.
Turn on Developer mode in Chrome or Edge (toggle at the top right). This reveals extension IDs, version numbers, and a "Inspect views" link that helps with later checks.
Write down every extension name, version, and ID. Copying the ID into a spreadsheet is worth the effort, because it lets you search the store later for the official listing.
Check whether any extension is listed as "Loaded unpacked" or "Installed from outside the Chrome Web Store." These are sideloaded and need extra scrutiny, since they bypass store review entirely.
Repeat for every browser profile. Work profiles, personal profiles, and guest profiles each have their own list.
Note any extension you do not recognize. Do not assume it is harmless because it came bundled with a PDF tool or a download manager, since those bundles are a common route for unwanted add-ons.

A worked example with real numbers

Consider a typical knowledge worker, "Priya," who runs Chrome for work and a separate personal profile. She counts her extensions and finds the following:

Work profile: 14 extensions
Personal profile: 19 extensions
Total: 33 extensions across two profiles

She sorts them by how often she has used them in the past month. Eleven are used daily or weekly, nine were used once or twice, and thirteen she cannot remember using at all. That is the first real finding: roughly 40 percent of her installed add-ons are dormant. Dormant extensions still run their content scripts on every page she visits, so they carry risk without delivering any value.

Her plan is simple. She removes the 13 she cannot remember, reviews the 9 occasional ones in detail, and keeps the 11 active ones for the permissions check. That reduces her attack surface by about 40 percent before she has even looked at a single permission.

How Do You Check an Extension's Permissions?

Permissions are the single most useful signal in an audit. They tell you what the extension can technically do, regardless of what its description promises. Each permission is a potential door, and the broadest ones deserve the most skepticism.

The permissions that deserve scrutiny

"Read and change all your data on all websites" (or the equivalent <all_urls> host permission): the extension can see and alter every page, including banking, email, and internal work tools.
"Read your browsing history": it can build a profile of where you go.
"Manage your downloads" or "Access your clipboard": it can observe or substitute data you copy, including cryptocurrency addresses and passwords.
"Read and change your data on specific sites": narrower, but still worth checking which sites.
"Native messaging" or "Access to the file system": the extension can communicate with programs installed on your computer, which expands the blast radius considerably.
"Proxy" or "Change your network settings": the extension can route your traffic through servers you do not control.

To review permissions, open the extension's details page in chrome://extensions and select "Details." Scroll to the permissions section, which Chrome lists in plain language. Firefox shows a similar list under the "Permissions" tab on each add-on's page.

The question that cuts through most cases

For each broad permission, ask: "Does the extension's stated job require seeing every site I visit?" A coupon finder that only activates on shopping sites does not need access to your email. A password manager needs broad access by design, and that is acceptable if the vendor is reputable and the extension is actively maintained. A dictionary tool that wants your browsing history has a problem.

If an extension asks for more than its job requires, remove it or find an alternative. A tool that fails the "why does it need this" test rarely earns a second chance.

How Do You Judge Whether a Publisher Is Trustworthy?

Permissions tell you what an extension can do. Provenance tells you whether you should trust the people behind it, and whether that trust is still warranted today. Many serious incidents involved extensions that were perfectly clean when first published, then changed hands.

Provenance checklist

Check the publisher name and verification status. Look for a verified publisher badge and a website you can actually reach.
Read the last-updated date. An extension untouched for more than 12 to 18 months may be abandoned, which means no one is fixing vulnerabilities.
Look at the version history and changelog. Sudden jumps in version number or a recent change in permissions after a long quiet period are red flags.
Check for ownership changes. Search the extension name with "sold" or "new owner." Several high-profile extensions were bought by unknown parties and then weaponized.
Read recent reviews, especially negative ones. Look for complaints about new ads, redirects, unexpected behavior, or settings being changed.
Check the privacy policy and store disclosures. Compare what the policy says about data collection with what the store listing discloses.
Review user count against review count. A huge install base with very few ratings can indicate inflated numbers or a recently bought listing.

Comparing audit tools and approaches

You do not need specialized software to run this audit, but some options make it faster. The table below compares common approaches on the criteria that matter most.

Approach	Cost	Ease of use	Permission visibility	Publisher and update checks	Best for
Manual review in browser settings	Free	Moderate	Good, per extension	Manual, time-consuming	Individuals with fewer than 20 extensions
Browser's built-in safety checks	Free	High	Limited	Limited to store policy enforcement	Baseline protection for everyone
Endpoint or enterprise security suite	Paid	Moderate to high	Strong, with central policy	Often automated	Organizations managing many devices
Browser policy management (group policy or MDM)	Included with some licenses	Lower, needs admin skills	Enforced allow or block lists	Admin-defined	IT teams standardizing browsers
Third-party extension-audit scanners	Free to paid	High	Strong, with risk scores	Varies by tool	Quick second opinion on suspicious add-ons

For most individuals, the honest recommendation is to combine the free manual review with the browser's built-in protections, then add a scanner only if you manage many machines or want a second opinion. Scanner scores are useful for triage but should never replace reading the permissions yourself, since risk scores can lag behind a freshly changed extension.