Most people audit their passwords, their app permissions, and maybe their phone's privacy settings. Very few audit the software sitting quietly inside their browser, reading every page they open. That gap matters more in 2026 than it did two years ago, because a growing share of browser extensions now send page content to large language model APIs, summarizers, "smart" assistants, and analytics backends. Some of that is disclosed. A lot of it is buried in a privacy policy nobody has read.
The surprising part is how little access an extension needs to see everything. A single content script with the "read and change all your data on all websites" permission can read the text of your bank statement, your draft email in a webmail client, your internal company wiki, and the form fields where you typed a password. If that script forwards any of it to an AI endpoint, your data has left the building, and nothing in your browser's interface will tell you so.
This article explains how that channel works, why it is easy to miss, and how to run a practical audit that you can finish in an afternoon. You will get a step-by-step process, a worked example with real numbers, a comparison of audit methods, and a clear way to decide which extensions deserve to stay. If you want a broader cleanup pass afterward, our guide on browser extension audits and removing risky add-ons covers the removal side in more depth.
Key Takeaways
- Any extension with "read and change data on all websites" can read the full text of every page you visit, including logged-in pages.
- Many AI-branded extensions send page content to third-party model APIs, often as a "summarize" or "assist" feature you may have never triggered on purpose.
- Permissions tell you what an extension can read; network behavior tells you what it actually sends. You need both to audit properly.
- Start with an inventory, then score each extension on permissions, data destination, and maintainer trust before deciding to keep it.
- Use a separate browser profile for sensitive work (banking, admin consoles, client systems) so extensions you trust for research never touch it.
- Re-audit every quarter, because extensions change owners, add AI features through updates, and rarely announce it.
What Does It Mean for a Browser Extension to Be an AI Channel?
An AI channel is any path through which content from your browsing session reaches a machine learning model, whether that model runs locally on your device or on a remote server. For most users, the concerning case is the second one: the page text, selected text, or form data leaves your machine and is processed by a third party.
Extensions become AI channels in a few common ways:
- Summarizers and writing assistants that read the whole page to generate a summary, rewrite a paragraph, or check grammar.
- Research and shopping tools that extract product or article data and send it to an LLM to classify or compare.
- Chat sidebars that attach the current page as context to every question you ask.
- Telemetry pipelines that include page snippets in error reports or "feature usage" events, sometimes sent to analytics providers that also run models.
- Silent updates that add an AI feature to an extension you installed years ago for something unrelated, like a coupon finder or a tab manager.
The last category is the one people underestimate. An extension you trusted in 2022 may have been acquired, rebranded, and given an AI layer in a minor version bump. Your permissions may not change at all, so the update looks harmless in the Chrome Web Store listing even though its behavior changed completely.
Permissions Versus Behavior
Permissions are the contract the extension asks you to accept. Behavior is what the code does at runtime. Auditing only permissions is like checking a locksmith's license without watching what they do inside your house. Permissions give you the ceiling on what is possible; network traffic and documented data flows tell you what is happening.
A useful rule: a permission that grants read access to all sites is a precondition for an AI channel, not evidence that one exists. Most extensions with that permission are harmless. The audit exists to separate the ones that are harmless from the ones that are quietly forwarding page content.
How Do You Inventory Every Extension in Your Browser?
You cannot audit what you have not listed, and most people have far more extensions than they remember. A common finding in audits is that the average user has between 8 and 15 extensions installed, and roughly a third of them were installed for a one-time task and never removed. Before evaluating anything, build a complete list.
- Open your browser's extension management page. In Chrome or Edge, type
chrome://extensionsoredge://extensionsin the address bar. In Firefox, go toabout:addons. - Turn on developer mode if your browser offers it (Chrome and Edge show it as a toggle in the top right). This reveals extension IDs, which you will need later.
- For each extension, record the name, the extension ID, the version number, the publisher name, and whether it is enabled.
- Click "Details" on each extension and note the "Permissions" section and the "Site access" setting. Look specifically for "Read and change all your data on all websites" or "On all sites."
- Check whether the extension has a "Site access" setting of "On click" or "On specific sites." Extensions set to "On click" only run when you act, which is much safer.
- Record the date of the last update, which you can find on the store listing page.
- Save the list to a spreadsheet. You will add scoring columns in the next step.
A quick worked example shows why this matters. Suppose you have 12 extensions. Four have all-sites read access. Two of those four were last updated more than 18 months ago and have no visible publisher. That leaves two extensions, plus anything the other eight could inherit through a future update, that deserve closer inspection. The inventory alone has narrowed a messy problem to a manageable one.
How Do You Check What an Extension Actually Sends Over the Network?
This is where most audits become genuinely informative. The method is to watch outbound requests while you use the page, then see which destinations receive data. You do not need to be a security engineer to do this, but you do need patience.
- Open your browser's developer tools (F12 or Ctrl+Shift+I on Windows and Linux, Cmd+Option+I on macOS) and go to the Network tab.
- Enable "Preserve log" so requests survive page navigation.
- Load a page that contains text you would not want shared, such as a draft or an internal dashboard using a test account. Do not use real sensitive credentials for this step.
- Trigger the extension's main feature. For a summarizer, click summarize. For a chat sidebar, ask it a question.
- Filter the Network tab for requests with the POST method. POST requests carrying page content are the ones to scrutinize.
- For each POST request, note the destination domain. If it points to a model provider API (for example, an
api.openai.com,api.anthropic.com, or a generic/v1/chat/completionspath on an unfamiliar host), the extension is forwarding content to an LLM. - Expand the request payload and look for the page text, URL, or form values. Many extensions send the page's visible text as a JSON field called something like
content,context, orpage_text. - Repeat the test on a second page and a third, because some extensions only send data on certain domains.
If you see no outbound POST with page content during normal use, that is strong evidence the extension is not an active AI channel, though you should still review its privacy policy. If you do see such requests, you have found a concrete data flow to evaluate against your own risk tolerance.
A Before-and-After Scenario
Consider a freelance developer who uses an AI "writing assistant" extension to polish client emails. Before the audit, she assumed it only ran when she clicked its icon. A network check showed it also sent the full text of every Gmail thread it could see to a model endpoint on any page where the icon had been opened even once, and it kept running in the background on mail.google.com. After she switched it to "On click" site access and tested again, outbound content requests dropped to zero until she pressed the button. She kept the tool, but her client correspondence stopped leaving her machine on its own.
What Are the Main Ways to Audit Extensions, and How Do They Compare?
You have several options, and they differ in effort, depth, and how much technical skill they demand. The table below compares five common approaches on the criteria that matter most when you are deciding how deep to go.
| Audit method | Effort | Technical skill needed | Catches network data flows? | Catches silent updates? | Best for |
|---|---|---|---|---|---|
| Manual permission review | Low | Low | No | Partly | Quick first pass |
| Privacy policy reading | Medium | Low | Partly (stated, not verified) | Only if policy is updated | Understanding stated intent |
| DevTools network monitoring | Medium | Medium | Yes | Yes, if rerun after updates | Verifying AI data flows |
| Dedicated extension scanners | Low to medium | Low to medium | Varies by tool | Often yes | Fleets and teams |
| Separate browser profile testing | High | Medium | Yes, isolated | Yes | Sensitive work environments |
In practice, combine at least two methods. A permission review finds candidates; network monitoring confirms behavior; a privacy policy read tells you whether the observed flow is disclosed. Relying on any single method leaves a blind spot.
When a Dedicated Scanner Is Worth It
If you manage more than a handful of machines, manual auditing does not scale. Scanners and enterprise browser management consoles can list extensions across a fleet and flag high-risk permission combinations. They are less useful for a single user who wants to understand one tool's behavior, because they tell you what exists rather than what a specific feature sends. Use them for breadth, then do targeted DevTools checks on anything flagged.
How Should You Score Each Extension and Decide What to Keep?
Once you have inventory and behavior data, you need a decision rule. Without one, people either keep everything out of inertia or delete everything out of anxiety. A simple scoring model works well. Give each extension points across four factors, then sort.
- Access scope (0 to 3): 0 for "On click" only, 1 for specific sites, 2 for many sites, 3 for all sites with always-on behavior.
- Data egress (0 to 3):
