Last month I watched an "AI writing assistant" extension quietly read every email in a colleague's inbox during a screen share. It had permission to. He'd installed it eight months earlier to fix his grammar, clicked through the permission dialog in about two seconds, and never thought about it again. The extension had access to Read and change all your data on all websites, plus a cloud API it phoned home to every few seconds.
Here's the uncomfortable part: this is normal. A 2023 study of the Chrome Web Store found that roughly 280 million users had installed extensions later flagged for malware, policy violations, or aggressive data collection. AI-powered extensions make this worse, because the whole point of an AI feature is that it needs to see your content to be useful. The line between "reads the page to help you" and "reads the page and ships it to a server you've never heard of" is one permission string wide.
This guide is a practical, no-fluff process for vetting browser extension AI permissions before you grant them. You'll learn how to read the permission manifest like an auditor, spot the five red flags that matter most, run a real before/after audit on your own browser, and compare the tools that make this less painful. By the end you should be able to look at any extension and answer one question with confidence: does this thing deserve to see what I see?
Key Takeaways
- Permissions are a contract, not a formality. "Read and change all your data on all websites" means exactly that, including your bank and email.
- AI extensions send data off-device by default. If there's no local model, assume your page content is leaving your machine.
- Check the four signals every time: permission scope, host list, update history, and the privacy policy's data-sharing clause.
- Least privilege wins. Prefer extensions that ask for access to specific sites over all sites, and activate on click instead of always.
- Audit what you already have. Most users carry 3–5 extensions they forgot about, each a standing risk.
- Vetting takes about 5 minutes per extension. That's cheaper than a breach.
What "AI permissions" actually mean in a browser extension
An extension can't do anything the browser doesn't let it do. Every capability it has is declared in a file called the manifest.json, and the browser turns those declarations into the permission prompt you see at install. For an AI extension, three permission types do almost all the damage.
The three permissions that matter most
- Host permissions (
host_permissions): which websites the extension can read and modify.<all_urls>means every site you visit, forever. - Content script injection (
content_scripts/scripting): the extension can inject JavaScript into pages, which is how it reads the text you're looking at and often how it rewrites or summarizes it. - Network access: technically not a single permission, but any extension can make outbound requests. Combined with host access, this is how your data reaches an AI model in the cloud.
For AI tools specifically, the risk is that these three combine. Host access lets it read the page, content scripts let it grab the text, and network access lets it send that text somewhere. That's a legitimate feature pattern for a summarizer. It's also exactly how a data-harvesting extension would operate. The permissions look identical; only the intent differs.
Chrome's permission wording, decoded
- "Read and change all your data on all websites" →
<all_urls>host access. The most dangerous. Skip unless the extension genuinely needs to work everywhere. - "Read and change your data on example.com" → scoped host access. Much safer, because damage is contained to one site.
- "Read your browsing history" → the
historypermission. An AI extension almost never needs this. - "Change your privacy-related settings" → a serious flag. Legitimate for a privacy tool, alarming for a writing assistant.
The 5-minute vetting checklist before you click "Add"
Do this before every install. It's quick once you've done it a few times.
- Read the permission prompt out loud. If the extension is a PDF-to-text summarizer, why does it want your browsing history? Mismatched permissions are the single loudest signal.
- Check the developer. Click through to the developer's site and email. A real company has a real domain, not a Gmail address and a Blogspot page. Cross-reference the name against the extension's listing.
- Scan the review count and velocity. 40,000 users and 12 reviews is a red flag. So are 300 reviews all posted in the same week (bought). Look for a steady curve over months.
- Read the update history. An extension last updated 3 years ago is unpatched. One that changed ownership recently (visible in some listings) may have been sold to a data broker, a well-documented pattern.
- Find the privacy policy and hit Ctrl+F. Search for the words
sell,third party,affiliate, andadvertising. If a "free" AI extension shares data with advertisers, you're the product. - Ask where the AI runs. Local (on-device) models keep data on your machine. Cloud models send it out. The listing usually says. If it doesn't, assume cloud.
If you're building a broader habit of only running software you've verified, the same instincts apply to desktop apps. Our guide on how to verify software downloads and avoid fake installers covers checksum verification and signature checks that translate directly.
Worked example: auditing a "free AI summarizer" step by step
Let's run the process on a realistic candidate. Say you found QuickSum AI, a summarizer with 90,000 users and a 4.6 rating. Tempting. Here's the audit.
Step 1: read the manifest
On Chrome, go to chrome://extensions, enable Developer mode (top right), and click Details → Inspect views, or open the extension's folder under your profile directory. The manifest shows:
"host_permissions": ["<all_urls>"]"permissions": ["scripting", "storage", "tabs", "history"]- A content script that runs on
"matches": ["<all_urls>"]atdocument_start
Verdict on this step: a summarizer needs to read the current page. It does not need history, and it does not need to run on all URLs at document_start (before the page even loads). That's two strikes.
Step 2: watch the network
Open DevTools (F12) on a test page, go to the Network tab, and trigger the summarize feature. You want to see:
- Where the request goes (the domain). Is it the developer's stated API, or an unknown third party?
- What's in the payload. Does it send only the article text, or the whole DOM including form fields?
- How often it fires. A summarizer should send data when you click summarize, not on a timer.
In our example, QuickSum AI fires a request to an analytics domain every 15 seconds even when idle, carrying the URL of every tab you have open. That's strike three. Uninstall.
Before and after: the actual risk change
| Data exposure | Before install | After install (bad extension) |
|---|---|---|
| Page content read | None | Every page, always |
| URLs tracked | Only your history, local | All open tabs, sent every 15s |
| Data sent off-device | 0 requests | ~5,760 requests/day |
| Third parties involved | 0 | 2 (API + analytics) |
That's the difference a single click makes. Nearly 6,000 outbound requests a day, carrying your browsing activity, from an extension you installed to shorten articles.
Local vs cloud AI extensions: which to trust
The biggest privacy fork in the road is where the model runs. This determines whether your data ever leaves your machine.
| Criteria | On-device (local) AI | Cloud AI (API) | Hybrid |
|---|---|---|---|
| Data leaves your machine | No | Yes, every request | Sometimes |
| Works offline | Yes | No | Partial |
| Model quality | Good, improving | Best available | Good |
| Privacy risk | Low | High | Medium |
| Needs host permissions | Still yes | Yes | Yes |
| Best for | Sensitive work | Casual, public content | Balanced use |
Note the last row of the table: even a local AI extension needs host permissions to read the page. Local processing reduces the network risk, not the read-access risk. A malicious local extension can still log what it sees. So "runs locally" is reassuring but not a free pass.
If you handle client data, contracts, or anything covered by NDA, treat cloud AI extensions as if you're pasting into a public forum. For a deeper look at how AI tools leak inputs, read our piece on how to stop AI chatbots from leaking your private conversations. The same containment principles apply to extensions.
Applying least privilege to every extension you run
Even after an extension passes vetting, you should give it the smallest amount of access it can function with. Chrome and Edge both support this per-extension.
Restrict site access
- Go to
chrome://extensionsand click Details on the extension. - Under Site access, change from On all sites to On specific sites or On click.
- On click is the gold standard: the extension has zero access until you deliberately activate it on a page.
For a grammar checker, "On click" turns an always-watching tool into an on-demand one. You
Cover image: iPhone firmware/software update 1.0.1 by Schill, licensed under BY 2.0 via Openverse.
