Most people install a browser extension the way they accept a cookie banner: a quick click, a glance at the star rating, and on to the next thing. Then, a few weeks later, a grammar checker quietly reads every form you type into, a coupon finder keeps a background connection to a server in another country, and a "tab manager" has permission to see every site you visit. Nobody announced this. It was all in the permission prompt, which almost nobody reads.
The scale of the problem is hard to ignore. Chrome's Web Store alone hosts well over 100,000 extensions, and security researchers have repeatedly found popular ones that were sold to new owners, updated with malicious code, or simply collected far more data than their listings admitted. Some of the worst cases involved extensions with millions of installs that had been legitimate for years before changing hands. The permission model is the only real checkpoint between a convenient add-on and full visibility into your browsing, your logins, and your work.
This article explains what browser extension permissions actually mean, which ones deserve your attention in 2026, and how to audit what you already have installed. You will get a step-by-step audit you can finish in about twenty minutes, a comparison of how different permission types expose you, and a clear rule set for deciding what to keep. The goal is not to make you paranoid about every extension. It is to help you spend your suspicion where it belongs.
Key Takeaways
- "Read and change all your data on all websites" is the most dangerous permission in common use. Treat it as a near-admin grant to your browser.
- Host permissions (which sites an extension can touch) matter as much as API permissions. An extension limited to one domain is a very different risk from one that runs everywhere.
- Permissions can be widened silently through updates. A tool you trusted at version 2 may request more at version 5, so re-audit after major updates.
- Ownership changes are a red flag. Check the developer, the publisher history, and whether the extension was recently sold or relisted.
- Remove anything you have not used in 30 days, and use the browser's own permission and site-access controls to downgrade what you keep.
- Fewer extensions is almost always safer. Each one is a standing trust decision you have to keep making.
What Are Browser Extension Permissions?
A browser extension permission is a declared capability that tells the browser what the extension is allowed to access before it runs. When you click "Add to Chrome" or "Add to Firefox," the browser shows you a list of these capabilities and asks you to approve them. Approval is the only gate. Once granted, the extension can use those powers for as long as it stays installed, including after updates that expand them.
Permissions come in two broad families, and confusing them is one of the most common mistakes people make:
- API permissions grant access to specific browser features, such as
storage(saving settings),tabs(seeing open tabs and their URLs),bookmarks,cookies,downloads,webRequest(inspecting network traffic), orclipboardRead. - Host permissions grant access to websites, expressed as URL patterns. A pattern like
https://mail.example.com/*is narrow. A pattern like<all_urls>or*://*/*means the extension can operate on every page you load.
The combination matters more than either alone. An extension with tabs and webRequest and all-sites host access can see where you go, read what you submit, and modify the responses you receive. That is the profile of a surveillance tool, whatever its marketing says.
The permission wording is a translation layer
Browsers translate technical permissions into plain language, and the translations are sometimes misleading in both directions. "Read and change all your data on all websites" sounds like a sweeping grant, and it is. But "Read your browsing history" can also hide the fact that the extension's developers are sending that history to a remote server for analytics. The prompt tells you what the extension is capable of. It does not tell you what it does with the capability. For that, you need the privacy policy, the developer's track record, and ideally a look at the network activity.
Which Permissions Should Actually Worry You in 2026?
Not every permission is a crisis. An extension that needs storage to remember your preferences is doing something ordinary. The permissions below are the ones that deserve a pause, roughly in order of concern.
Tier 1: Treat as high risk
- Read and change all your data on all websites (
<all_urls>). This lets the extension inject code and read content on every page, including banking, email, health portals, and internal company tools. Some legitimate password managers and accessibility tools need it. Most extensions that ask for it do not. - webRequest, webRequestBlocking, or declarativeNetRequest with broad scope. These let an extension see or alter network traffic. Ad blockers need this, which is why you should only trust well-established ones with a long track record.
- Cookies on all sites. Combined with host access, this allows session hijacking in principle and tracking across domains in practice.
- Clipboard read. Extensions that read your clipboard can capture passwords, crypto wallet addresses, and sensitive text you copy. Crypto address swapping is a documented attack pattern.
- Native messaging. This lets the extension communicate with a program installed on your computer, which turns a browser add-on into a bridge to your operating system.
Tier 2: Justify before keeping
- tabs. Reveals the URL and title of every open tab, which is a complete log of your attention if the extension sends it anywhere.
- history. Full browsing history access. Useful for a history manager; unnecessary for almost everything else.
- bookmarks. Less dramatic, but it reveals your interests and sometimes private projects.
- downloads. Can see and manipulate what you download.
- scripting or content_scripts on broad patterns. Injects code into pages, which is how most extensions do their work, but also how malicious code gets into your sessions.
Tier 3: Usually fine
- storage, alarms, notifications, contextMenus, activeTab (access only when you click the extension, which is a good design pattern).
The activeTab permission deserves special mention. It grants temporary access to the current tab only when you invoke the extension, instead of standing access to everything. When you see an extension that can do its job with activeTab but instead requests all-sites access, that gap is informative.
A Worked Example: Auditing a Realistic Extension Stack
Consider a typical knowledge worker. Say you have 23 extensions installed across Chrome on your work laptop, and you have never reviewed them. Here is how the audit tends to go, using round numbers that match what most people find.
Of the 23, roughly 6 request all-sites access. Of those 6, two are obvious and justified: a password manager and an ad blocker. Two are coupon and shopping tools you installed during a sale two years ago and have used maybe three times. One is a "PDF converter" you forgot about. The last one is a grammar assistant that you use daily, which is worth keeping but worth restricting.
Now apply the tiers. The coupon tools and the PDF converter fail the test: you do not use them, and their broad access buys you nothing. Removing three extensions out of 23 cuts your attack surface by a meaningful slice, and it also cuts the number of trust decisions you have to revisit. For the grammar assistant, you may be able to change its site access from "all sites" to "on click" in the browser settings, which keeps the feature and removes the standing access.
The end state is 19 extensions, 2 with all-sites access, both deliberate. That is a far better position than the starting point, and it took about twenty minutes.
Step-by-Step: How to Audit Your Extensions Today
- Open your extensions page. In Chrome or Edge, type
chrome://extensionsoredge://extensionsin the address bar. In Firefox, go toabout:addons. In Safari, open Settings and then Extensions. - Export your list. Write down every extension name, its version, and its developer. Screenshots work. You need a record to compare against later.
- Check the developer and publisher. Click each extension and look at the listed developer, number of users, last-updated date, and whether the publisher has a website. Be suspicious of extensions with recent ownership changes, generic developer names, or no privacy policy.
- Read the permissions. Click "Details" and then scroll to "Permissions" and "Site access." Note every entry from the tiers above.
- Identify the all-sites extensions. Filter your list mentally for anything with "all websites" or "all sites" access. These are your priority.
- Test necessity. For each high-risk extension, ask: what is the last time I used it, and does it need all-sites access to do that job? If the answer to the second question is no, restrict it.
- Restrict site access. In Chrome, open the extension's details and change "Site access" from "On all sites" to "On click" or "On specific sites." Firefox offers similar controls under "Manage Extension Permissions." This keeps the feature while removing standing access.
- Remove what you do not use. If you have not used an extension in 30 days, remove it. You can always reinstall.
- Check the Chrome Safety Check. In Chrome, go to Settings, then Privacy and Security, then Safety Check. It flags extensions that are known to be malicious or that violate policy.
- Schedule a recurring review. Put a calendar reminder every three months, and re-audit after any major extension update, since permissions can expand without you noticing.
Comparing How Extension Types Handle Permissions
Different categories of extension need very different levels of access, and it helps to know what "normal" looks like before you judge a specific tool. The table below compares five common types on criteria that matter for risk.
| Extension type | Typical permissions needed | Needs all-sites access? | Data exposure risk | Can it be restricted? | Typical red flag |
|---|---|---|---|---|---|
| Password manager | storage, activeTab, clipboard write, host access to login pages | Often yes, to autofill | Very high | Partially | Unknown developer or no third-party audit |
| Ad blocker | webRequest or declarativeNetRequest, all-sites access | Yes | High (sees all traffic) |
