Here's a number that should make you pause before your next one-click install: security researchers at Stanford and CISPA once found that over 280 million Chrome users had installed extensions containing malware, policy violations, or aggressive tracking code. That's not a fringe problem on some sketchy forum. Those extensions lived in the official Chrome Web Store, sat there for months, and in some cases racked up glowing five-star reviews before anyone noticed.
Browser extensions are the most under-scrutinized software most of us run. We agonize over which antivirus to buy, then grant a random "PDF converter" extension permission to read and change all our data on every website we visit. That single permission is enough to steal session cookies, inject affiliate links, scrape banking pages, and quietly log every keystroke you make.
This guide walks you through browser extension security the way a cautious professional actually does it: reading permission manifests, checking developer provenance, spotting the ownership-change trap that turns good extensions bad, and building a repeatable vetting checklist. You'll get a worked example, a comparison of vetting tools, and a step-by-step audit you can run in under ten minutes per extension.
Key Takeaways
- Permissions are the whole game. An extension that requests "read and change all your data on all websites" can do almost anything a website can do, including stealing logins.
- Ownership changes are the silent killer. Trustworthy extensions get sold to shady buyers who push malicious updates to an existing user base.
- Reviews and install counts lie. Both are trivially gamed. Provenance, source code, and update history tell the truth.
- Fewer extensions is better security. Every extension is attack surface. Audit quarterly and uninstall anything you haven't used in 30 days.
- Prefer first-party or open-source tools where the vendor's reputation and business model don't depend on monetizing your data.
Why Browser Extensions Are a Bigger Risk Than Most Software
A desktop app runs in a sandbox and usually asks the operating system for specific permissions. A browser extension runs inside the most sensitive application you own: the thing you use for banking, email, work dashboards, and password autofill.
When an extension gets the "read and change all your data on the websites you visit" permission, it can:
- Read the DOM of any page, including your bank balance and private messages.
- Grab session cookies and authentication tokens, letting an attacker impersonate you without your password.
- Inject scripts that modify what you see, from swapping crypto wallet addresses to hiding fraudulent charges.
- Exfiltrate everything to a remote server, silently, on every page load.
The kicker: extensions auto-update. You vetted version 2.1 last year and it was clean. Version 4.0 shipped this morning after the developer sold the project, and now it's a data-harvesting operation. You approved that update by doing nothing.
This is the same category of trust problem we cover in our guide on how to audit open-source software before adding it to your stack, and it's closely related to the newer challenge of vetting an AI agentic browser before giving it data access. The principle is identical: understand what the code can do before you trust it, not after.
The Permission Model: Reading What an Extension Can Actually Do
Before you install anything, click through to the extension's permission list. In Chrome and Edge you'll see it during install and later under chrome://extensions → Details. In Firefox it's under the extension's Manage page. Here's how to translate the vague labels into real risk.
Permissions ranked by danger
- Read and change all your data on all websites — Maximum risk. Only justify this for tools that genuinely need it (password managers, ad blockers). Question everything else.
- Access your browsing history — High. Lets an extension build a full profile of your activity for tracking or resale.
- Read and change data on
specific-domain.com— Moderate and often fine. A Gmail-specific tool asking only formail.google.comis behaving well. - Manage your downloads / read clipboard — Context-dependent. A screenshot tool needing downloads is reasonable. A "dark mode" toggle needing clipboard access is not.
- Display notifications — Low risk on its own.
The mismatch test
The single most useful heuristic in extension vetting is the permission-to-function mismatch. Ask: does what this extension does justify what it asks for?
A weather extension that wants to read data on all websites fails instantly. It should only need to talk to a weather API. When the ask is wildly larger than the function, the extra permission is the product, and you are the raw material.
A Worked Example: Vetting Two "PDF Merger" Extensions
Say you need a quick tool to merge PDFs in the browser. You search the store and find two candidates with similar names. Let's run both through a real vet.
Extension A — "Free PDF Merge & Convert Pro":
- Install count: 900,000. Rating: 4.7 stars from 3,100 reviews.
- Permissions requested: read and change all your data on all websites, read your browsing history, manage downloads.
- Developer: a generic Gmail address, no website, no privacy policy link that resolves.
- Last updated: 4 days ago, with an ownership change noted 2 months ago in a Reddit thread.
Extension B — "MergePDF by [named studio]":
- Install count: 40,000. Rating: 4.4 stars from 210 reviews.
- Permissions requested: manage downloads only. Merging happens locally in the browser.
- Developer: a real company with a website, a support address, and a clear privacy policy.
- Last updated: 6 weeks ago, consistent version history for 3 years, same publisher throughout.
Extension A has 22x the installs and a higher rating. It's also the obvious trap. A PDF merger has no legitimate reason to read data on all websites or access your browsing history. Merging is a local operation. Extension B does the exact same job with a single, appropriate permission, a real business behind it, and a clean multi-year update history under one owner.
Verdict: install B. The high install count on A is a warning sign, not reassurance, because it means a large captive audience is waiting for the next malicious update. This is why we always tell readers to weight provenance over popularity. The same instinct that makes you choose vetted tools from a curated software marketplace over a random download should govern your extensions.
How to Vet a Browser Extension: A 9-Step Walkthrough
Here's the repeatable process. Budget about 8 to 10 minutes per extension the first few times. It gets faster.
- Read the permission list first, before anything else. Open the store listing and expand the permissions. If it asks to read and change data on all sites, demand a concrete reason.
- Apply the mismatch test. Compare requested permissions to the stated function. Any excess is a red flag.
- Identify the developer. Click the publisher name. Is there a real company, a website that loads, and a working support contact? A missing or dead website is disqualifying for anything sensitive.
- Find the privacy policy and actually skim it. Look for the phrases "we collect," "third parties," and "sell." If there's no policy or it's a copy-paste template, walk away.
- Check the update and ownership history. Search "[extension name] sold" or "[extension name] malware" plus the current year. The extension community documents ownership changes fast.
- Read the 1-star reviews, not the 5-star ones. Sort reviews by newest and lowest. Recent complaints about ads, redirects, or "it changed after an update" are the signal you want.
- Inspect the source if it's open. For Firefox add-ons and many Chrome extensions, you can view the code. Look for obfuscated blobs, remote script loading (
evalof fetched code), and hardcoded tracking domains. - Test in an isolated profile. Create a fresh browser profile with no logins, install the extension there, and watch its network activity in DevTools for a day before promoting it to your main profile.
- Set a review reminder. Extensions change. Recheck permissions quarterly and after any major version bump.
Watching network traffic in DevTools
Step 7 and 8 are where you catch the sneaky ones. Open DevTools (F12), go to the Network tab, and load a normal page. If a "grammar checker" extension is firing requests to an unfamiliar analytics or ad domain on a page that has nothing to do with writing, you've found your exfiltration channel. Note the domain, block it, and uninstall.
Extension Vetting Tools and Approaches Compared
You don't have to do all of this by hand. Several tools and methods help, each with tradeoffs. Here's how the main approaches stack up.
| Approach | Cost | Effort | Catches Bad Permissions | Catches Post-Install Changes | Best For |
|---|---|---|---|---|---|
| Manual permission + review audit | Free | Medium | Yes | Only if you recheck | Everyone, as a baseline |
| Extension analyzers (CRXcavator-style scanners) | Free | Low | Yes | Partial | Quick risk scoring |
| Isolated test profile + DevTools | Free | High | Yes | Yes | High-sensitivity setups |
| Enterprise extension allow-listing | Paid | Setup-heavy | Yes | Yes | Teams and businesses |
| Do without the extension | Free | None | N/A | N/A | Anything non-essential |
