Choosing Browser Extensions Safely

Browser extensions are software running inside the browser with access to what you do there. Most are fine. The failure mode, when it occurs, is severe and difficult to notice.

What the permissions mean

When an extension asks to read and change all your data on all websites, that is what it can do: see every page's content, every form field, and modify what you see.

That permission is genuinely required for some categories — ad blockers, password managers, grammar checkers, translation tools all need broad access to work.

It is also requested by many extensions that do not need it, and it is the mechanism behind essentially every extension-related incident.

Narrower permissions to prefer: access on click, access to specific sites, access only to the active tab. An extension offering these is telling you something good about how it was built.

The pattern to know about

The documented lifecycle of a compromised extension:

A developer builds something useful and free. It accumulates users. Maintaining it is unpaid work.

Someone offers to buy it, or offers payment to include a small module. The developer accepts.

The new owner pushes an update. Because extensions update automatically and silently, every user receives it without action.

The update injects advertising, rewrites affiliate links, collects browsing history, or worse.

This has happened repeatedly and across every major browser's store. The important detail is that the extension you vetted is not necessarily the extension you are running today.

Evaluating before installing

Who publishes it? A named company or a known open-source project is a different proposition from an anonymous developer.

Is the source available? Open source does not guarantee the published build matches, and it makes scrutiny possible.

How many users, and how old? Both matter; neither is decisive, since large old extensions are exactly what gets acquired.

Read the recent reviews, sorted by newest. A sudden run of complaints about advertising or slowness is the clearest early signal of a bad update.

What permissions does it request, and do they make sense? A theme that wants to read all sites is not a theme.

Does it have a privacy policy that says anything specific?

Does it match a built-in feature? Screenshot tools, reader modes, tab management and PDF viewing are all built into modern browsers. Installing an extension for something the browser already does is taking a risk for nothing.

After installing

Review your extensions twice a year. Remove anything you do not actively use. Every one is an ongoing grant of access.

Restrict site access. Right-click an extension icon and set it to run on click, or on specific sites only. Most extensions work fine this way, and it dramatically reduces exposure.

Watch for behaviour changes. New tabs opening, unexpected advertising, a changed search engine, or pages loading more slowly are all worth investigating.

Check what is installed that you did not install. Bundled software sometimes adds extensions. The extensions page shows everything, including those installed by other programs.

Categories that need care

Anything free with an expensive-to-run service behind it — VPN extensions, unlimited cloud tools, coupon finders. The money comes from somewhere.

Coupon and cashback extensions, which by design see your shopping and rewrite affiliate parameters.

Screenshot and download managers, which have been repeatedly implicated and which duplicate built-in functionality.

"Cleaner" and "optimiser" extensions, which have nothing meaningful to clean in a browser.

Extensions that require signing in to use a basic feature.

Categories generally worth having

A content blocker from a reputable open-source project. Genuinely improves security by blocking malicious advertising, as well as speed.

A password manager, from a company whose business model is the password manager.

A specific tool for your work that you would notice if it stopped.

That is a short list, and a short list is the right shape. Ten extensions is ten independent grants of access to everything you do in the browser.

If something has gone wrong

Remove the extension. Clear cookies and site data. Change passwords for anything important, from a different browser or device. Check your browser's search engine and homepage settings, which are common targets. Check for other extensions installed at the same time.

And check whether the extension was signed in to a sync account, in which case it may reinstall on your other devices.

Mistakes people make

Granting all-sites access by default. Most extensions work fine restricted to specific sites or set to run on click, and that removes most of the exposure.

Vetting once and never again. Extensions update silently. The one you checked two years ago may have changed hands since.

Installing an extension for something the browser already does. Screenshots, reader mode, tab management and PDF viewing are all built in.

Judging by user count. Large, established extensions are exactly what gets acquired and monetised.

Ignoring a run of recent negative reviews. Sorted by newest, they are the earliest reliable signal of a bad update.

Keeping extensions you no longer use. Each is an ongoing grant of access to everything you do in the browser.

The short answer

Keep a short list — a content blocker, a password manager, and whatever your work genuinely requires. Restrict each to specific sites or on-click. Review them twice a year and remove anything you are not actively using.