What an extension is
A browser extension is a small program that runs inside your web browser and changes how it behaves. Popular examples include ad blockers, password helpers, dark-mode tools, grammar checkers, tab organisers and price trackers. Extensions are usually written with ordinary web technologies, installed from the browser maker’s own add-on store, and can be switched off or removed at any time.
They are useful precisely because they sit in a powerful position: between you and the web pages you view. That same position is what makes them worth treating with some care.
What access an extension can have
When you install an extension, the browser shows a list of permissions it asks for. The wording differs between browsers, but the common ones are:
- Read and change data on all websites. This is the broadest. The extension can see the content of every page you open and can alter it. That can include text you type into forms, depending on how the extension is built.
- Read and change data on specific sites. Narrower, and a better sign for a tool that only works on one service.
- Browsing history or tabs. The extension can see which sites you visit and what is open.
- Cookies. The extension can read the small files sites use to remember you. Our article on browser cookies explains what these hold, and a session cookie can be especially sensitive.
- Clipboard, downloads, notifications or storage. More limited, but each is a capability that a simple tool may not need.
Many genuinely harmless extensions request broad access because it is the easiest way to build the feature. A dark-mode tool, for example, has to change the appearance of every page. Broad access is therefore not proof of bad intent, but it does mean that you are trusting the author, and anyone who later takes over the extension, with a large amount of your browsing.
Where the hidden risks come from
Most problems are not dramatic hacks. They tend to fall into a few ordinary categories.
Data collection by design. Some free extensions earn money by collecting browsing data, such as the pages you visit, and passing it to other companies. This overlaps with the wider topic of online tracking, and the extension’s privacy policy is the place to look, although policies can be vague.
Ownership changes. An extension that was once built by a careful hobbyist can be sold to a new owner. Because updates install automatically in most browsers, the new owner can add data collection or advertising in a later version without you noticing. This is one of the less obvious risks, since the extension looks the same in your toolbar.
Copycats. Stores sometimes carry extensions with names and icons that imitate popular ones. Reviews can be misleading, as they may be few, copied or paid for.
Bugs. Even honest extensions may contain security flaws. A flaw in a tool that can read every page is more serious than a flaw in a tool with narrow access.
Stale software. Abandoned extensions stop receiving fixes, and browsers occasionally change rules in ways that leave old extensions behaving oddly.
Store review does catch some of this, but, as with the app stores that vet mobile apps, no review process is perfect, and a harmful extension can stay available for some time before being removed.
How to judge whether one is worth installing
No single check settles it, but a few questions are practical:
- Do you need it? An extension that saves minutes every day is easier to justify than one you tried once out of curiosity.
- Does the permission list match the job? A calculator that wants to read all sites is a mismatch. A price tracker asking for access to shopping sites is more reasonable.
- Who made it? A named developer or company with a website, a support address and a track record is generally easier to trust than an anonymous listing. Browser makers sometimes mark extensions they have reviewed more closely, which is a mild positive signal, not a guarantee.
- How does it make money? If the tool is free and there is no obvious business model, consider that your data may be part of it. Paid tools, tools from known organisations and open-source projects with public code can be easier to assess, though none are automatically safe.
- Is it maintained? Look for a recent update date and for sensible replies to user problems.
- Does a built-in feature already do the job? Modern browsers include password saving, translation, reader views and tracking protection. A built-in tool avoids adding another party.
Reading a few of the lower-rated reviews often tells you more than the average star rating does, as complaints about sudden ads or changed behaviour appear there.
Keeping the number small
A sensible habit is to treat extensions like apps on a phone: install few, review them from time to time, and remove what you no longer use. Opening the extensions page every few months and asking “do I still use this, and does it still need these permissions?” takes a minute. Many browsers also let you restrict an extension so that it only runs when you click it, or only on certain sites, which cuts its reach without losing the tool.
If you use a password manager, its extension is one of the more sensitive ones because it handles your logins, so it is worth choosing that one deliberately. For general privacy, a private browser with sensible built-in defaults may reduce your need for add-ons in the first place.
If you think one has misbehaved
Signs include new toolbar buttons you did not add, unexpected ads, a changed search engine or home page, or the browser slowing down after an update. In that case:
- Disable or remove the extension, then restart the browser.
- Check the other extensions in the same way.
- Consider changing passwords for important accounts, especially if the extension had access to all sites, and turning on two-factor authentication where you have not already.
- Run the security tools built into your operating system or browser if you are still concerned.
Extensions are not something to fear, but they are a case where convenience is paid for in trust, so it is worth spending a moment on each one.