Browser Extensions and Permissions

Browser extensions are the most privileged software most people install without thinking. An extension with permission to read and change data on all sites can see your email, your banking session, everything you type.

What the permissions mean

"Read and change all your data on all websites." Complete access to every page. Content, form fields, session cookies. This is the permission most extensions request and it is effectively total.

"Read your browsing history." Every page you visit.

"Manage your downloads" / "Read and change your data on specific sites." Narrower, and worth preferring.

Extensions can inject scripts, modify pages, and send anything they see to a server. No further permission is needed once site access is granted.

The failure mode that matters

Most extensions do not start malicious. They start useful, acquire users, and then change.

They get sold. An established extension with a large user base is a valuable asset precisely because of its installed permissions. Purchasers have repeatedly added tracking, affiliate link injection or data collection after acquisition. Updates install silently.

The developer monetises. A hobby project that becomes expensive to maintain, and analytics is the easiest revenue.

They are compromised. Developer accounts get phished, and a malicious update ships to everyone.

A dependency is compromised. The extension's own libraries.

This is not hypothetical. Every major browser store has removed extensions with millions of users after they turned. The pattern recurs.

Auditing what you have

Worth an occasional twenty minutes.

List every extension and ask whether you use it. Most people have several they installed once.

Check the permissions each holds. Anything with all-sites access should be justifying it.

Check whether it has changed hands. The developer name and the listing description are visible in the store, and a change of publisher is worth noticing.

Check the update history and reviews. Recent reviews complaining about new behaviour are the earliest warning available.

Remove what you do not use. An unused extension retains its permissions.

Choosing one

Prefer narrow permissions. An extension that works on specific sites is far safer than one with universal access.

Prefer open source with an active repository, where behaviour can be inspected.

Check the publisher. A named organisation with a website beats an anonymous developer.

Check the user count and age. Both help, and neither is sufficient, since large established extensions are exactly the acquisition targets.

Be sceptical of free tools with no business model. Coupon finders, price comparison, "free VPN", download helpers and screen recorders are the categories most consistently associated with data collection.

Read recent reviews rather than the average. The average reflects the extension as it was.

The AI extension category specifically

A wave of extensions offering assistant features requests full site access, which their function genuinely needs — they read the page to summarise it.

That means the extension sees everything. Your email, your documents, your internal systems.

The questions to ask: who publishes it, where does the page content go, is it processed on a server, is it retained, is it used for training. Many of these extensions are thin interfaces over an API with a data policy nobody has read.

Prefer the browser's own built-in features or an extension from a company whose main business you can identify.

Practical arrangement

Keep the number small. Five extensions you use daily is a reasonable target.

Use a separate browser profile for anything sensitive — banking, work — with no extensions at all. This is the strongest single measure and it costs nothing.

Review twice a year.

Do not install an extension recommended in a comment, an advert or a video description.

Watch for extensions installed by other software, which is a common and under-noticed route.

The separate profile arrangement

The strongest single measure in this area, and it costs nothing.

Create a second browser profile with no extensions at all. Every major browser supports this.

Use it for banking, work systems and anything with real consequences.

Use your normal profile, with its extensions, for everything else.

The profiles have separate cookies, sessions and storage, so an extension in one cannot see the other.

This also solves account separation — work and personal signed in simultaneously without conflict.

Pin them separately so switching is a click.

The reason this works is that the risk from extensions is not that they are malicious today; it is that one of them may become malicious after an acquisition or a compromise, silently. A profile with none of them is unaffected by that regardless of what happens.