Chrome's extension ecosystem is one of the most useful and most dangerous corners of your computer. In late 2023 and through 2024, Google shipped a wave of Manifest V3 enforcement changes and security patches that reshaped what extensions can and cannot do. If you installed a productivity extension eighteen months ago and never looked at it again, there is a real chance its permissions, ownership, or behavior has quietly changed under your feet.
Here is the number that should make you pause: security researchers at Stanford and CISPA analyzed the Chrome Web Store and found that more than 280 million users had installed extensions containing malware, policy-violating code, or abandoned software over a three-year window. Many of those extensions were perfectly reputable when first published. They turned hostile after being sold, hijacked, or updated with a poisoned build.
This guide walks you through how to vet Chrome extension security the way I do it after every major browser patch cycle. You'll learn how to read the permission model, spot ownership changes, audit update history, use a repeatable checklist, and decide when an extension should simply be removed. No theory-only advice. Every step is something you can run today.
Key Takeaways
- Re-audit installed extensions after every major Chrome security patch, not just at install time. Ownership and code can change silently.
- Permissions are the single highest-signal indicator. An extension requesting
<all_urls>access needs a far higher bar than one scoped to a single domain.- Check the developer's identity, last update date, and review velocity. Sudden ownership transfers are the most common precursor to malicious updates.
- Use
chrome://extensionsin Developer Mode plus a network inspector to see what an extension actually does, not what it claims.- Manifest V3 reduced but did not eliminate risk.
declarativeNetRequestand remote-hosted config still enable abuse.- Prefer vetted tools from accountable vendors over free extensions with anonymous maintainers.
What Changed After the Latest Chrome Security Patches
The most important shift is the full rollout of Manifest V3. Google began disabling Manifest V2 extensions for most Chrome users during 2024, and enterprise holdouts lost their extension in mid-2025. This matters for vetting because the two manifest versions have fundamentally different threat surfaces.
Manifest V2 vs Manifest V3 at a glance
Under V2, extensions could load and execute remote JavaScript at runtime. That meant an extension you audited on Monday could pull down entirely new, malicious code on Tuesday without any store update. V3 removes remotely hosted code and pushes network filtering into a declarative rules system.
- Remote code: V2 allowed it. V3 forbids it. This is the biggest security win.
- Background pages vs service workers: V3 uses ephemeral service workers, which limits always-on surveillance behavior.
- Network interception: V2 used the powerful
webRequestblocking API. V3 usesdeclarativeNetRequest, where rules are declared up front and reviewable.
The catch: V3 is not a magic shield. Extensions can still exfiltrate page content, read your clipboard, inject scripts into every site, and phone home with your browsing data. The rules got tighter, but a determined developer or a compromised update pipeline can still cause real damage. That's precisely why post-patch re-auditing matters.
How to Read Chrome Extension Permissions Like a Security Analyst
Permissions are where 80% of your vetting decision gets made. Chrome groups them into host permissions (which sites the extension can touch) and API permissions (what browser capabilities it can use). Learn to read both.
The permission risk ladder
Not all permissions are equal. Here's how I mentally rank them from benign to alarming:
- Low risk:
storage,alarms,notifications, activeTab. These are common and rarely dangerous. - Medium risk:
tabs,cookies,scriptingscoped to specific domains,downloads. - High risk:
<all_urls>or*://*/*host access,webRequest,debugger,nativeMessaging,clipboardRead.
A grammar checker that only needs to read text you type inside a text box should not be requesting access to all cookies on every website. When the permission scope wildly exceeds the stated purpose, that mismatch is your signal to dig deeper or walk away.
A worked example: the "free PDF converter" test
Say you find a Chrome extension called QuickPDF Merge with 400,000 users and a 4.6-star rating. Looks safe. You open its details and see it requests:
<all_urls>(read and change all your data on all websites)cookieswebRequesttabs
A PDF merger operates on files you upload. It has zero legitimate reason to read cookies across every site or intercept network requests. That single mismatch drops my trust from "probably fine" to "do not install." Compare that to a competitor with 60,000 users that requests only storage and activeTab. Fewer users, but a permission footprint that actually matches the job. I'll take the second one every time.
Step-by-Step: How to Vet a Chrome Extension After a Patch
Here is the exact repeatable process. Budget about ten minutes per extension the first time, then two or three minutes on recurring audits.
- Open your extension inventory. Navigate to
chrome://extensions. Toggle Developer mode on in the top right. This reveals the extension ID and lets you inspect background service workers. - List every extension and its ID. Copy each extension's ID (the long string of letters). You'll use it to look up the store listing and verify the developer.
- Review each permission set. Click Details on each extension and read the "Permissions" and "Site access" sections. Flag anything requesting all-site access it doesn't obviously need.
- Check the last update date and version. On the Chrome Web Store listing, note when the extension was last updated. Abandoned extensions (no update in 12+ months) are a liability because they won't be patched against new exploits.
- Verify the developer identity. Look for a verified publisher badge, a real company name, a support email, and a working website. Anonymous or freshly created developer accounts on high-permission extensions are a red flag.
- Read the recent reviews, sorted by newest. Old five-star reviews mean nothing if the last month is full of "this used to be great, now it injects ads." Ownership changes show up in review sentiment before they show up anywhere else.
- Inspect the service worker. In Developer mode, click the "service worker" link under the extension. Open the Network tab and watch what domains it contacts. An offline calculator that beacons to an unknown analytics server deserves scrutiny.
- Cross-check against silent-install lists. Some extensions arrive bundled with other software without your explicit consent. Our guide on how to detect and remove silently installed browser extensions covers this exact failure mode.
- Decide: keep, restrict, or remove. If everything checks out, keep it. If it's mostly fine but over-permissioned, restrict site access to specific domains under "Site access." If anything smells wrong, remove it and clear associated data.
How to restrict an extension without removing it
Chrome lets you scope host access per extension. Under Details → Site access, change "On all sites" to "On specific sites" and add only the domains where you actually use it. A price-tracker extension might only need access to amazon.com and bestbuy.com, not your bank. This single setting neutralizes a huge chunk of extension risk.
Comparing Ways to Audit Extension Trust
There's no single tool that does everything. Here's how the common approaches stack up on the criteria that matter for a real audit.
| Method | Detects over-permissioning | Detects ownership change | Detects live network calls | Effort |
|---|---|---|---|---|
Manual chrome://extensions review |
Yes | Partial | Yes (via service worker) | Medium |
| Chrome Web Store listing check | Yes | Yes (via reviews) | No | Low |
| Third-party scanner (e.g. CRXcavator-style) | Yes | Partial | Static only | Low |
| Network inspection (DevTools) | No | No | Yes | High |
| Enterprise policy allowlist | Yes | Yes | No | High setup |
The takeaway: combine at least two methods. A store listing check plus a manual permission review catches the majority of problems in a few minutes. For anything with all-site access, add the network inspection step.
Ownership Changes: The Threat Most People Miss
The most dangerous extension scenario isn't a brand-new malicious app. It's a beloved, trusted extension that gets acquired and then weaponized. This has happened repeatedly with popular utilities that got sold to shady buyers who pushed an update laced with ad injection, affiliate hijacking, or full-page tracking.
Because updates roll out automatically, the poisoned version lands on your machine without any action on your part. That's why the "last update" date and "newest reviews" checks in the walkthrough above are non-negotiable.
Warning signs of a compromised or sold extension
- A sudden update that dramatically expands permissions.
- The developer name or contact email changed since your last visit.
- A cluster of recent one-star reviews mentioning ads, redirects, or slowdowns.
- The privacy policy link now points to a different, generic domain.
- The extension started asking to "read and change all your data on
Cover image: Innovate Maryland Emerging Technology Center by MDGovpics, licensed under BY 2.0 via Openverse.
