Are browser extensions safe? What to check before installing one

Most extensions are safe, but the question is worth asking, because an extension with the common "Read and change all your data on all websites" permission can see every page you load — including your email, your bank, and anything you type into a form. That is a level of access no ordinary website has, and you grant it in one click.

The checks that matter take about a minute: does the permission it asks for match the feature it describes, who publishes it and have they been around, what do the newest reviews say, and does it need an account or send your data somewhere. Those four questions catch the overwhelming majority of bad installs. The rest of this is what each one means and how to act on the answers.

What can a browser extension actually access?

An extension holding the broad host permission can read and change the content of every page you visit, see what you type into those pages, and send any of it to a server. Extensions do not run in the same sandbox a web page does, which is why the stakes are higher than they look.

A normal web page can only see itself. It cannot read the tab next to it. An extension with broad host permissions runs code inside the pages you visit — it can read the text on the page, see what you type, modify what is displayed, and send any of it to a server. It keeps doing this on every page, in the background, whether or not you clicked its button.

That is not sinister by itself. It is exactly what a password manager, an ad blocker or a dark-mode tool needs in order to function. The point is that the permission is genuinely powerful, so it should be matched to a genuine need rather than granted by reflex.

Does the permission match the feature it describes?

Read the extension's description of what it does, then read the permission warning the browser shows at install, and ask whether the first plausibly requires the second. A mismatch between the two is the single most useful warning sign available, and checking for it is the step almost everyone skips.

Some contrasts that make the mismatch obvious:

• A tool that only acts when you click its toolbar button can usually use the narrow activeTab permission, which grants access to one tab at the moment you click — not to everything, always.
• A tool that improves one specific website should be scoped to that site's domain.
• A theme or a new-tab page has no business reading the content of the pages you browse.
• A currency converter that works on selected text needs the current tab when invoked, not a continuous view of your browsing.

When a small, single-purpose extension asks for access to everything forever, that mismatch is the signal. It is not proof of bad intent — using the broad permission is simply easier than scoping properly, and plenty of developers take the shortcut. But carelessness about permissions is not a quality you want in software with that much reach.

Who publishes the extension, and how long have they been around?

On a Chrome Web Store listing, look at the publisher name and whether it links to a real website or email. An extension published by a recognisable name with a real site behind it is a different proposition from one published by an account with no other presence.

The store shows badges worth understanding:

• A Featured badge indicates the extension follows the store's technical and user-experience best practices. It is a quality signal, not a security audit.
• An Established publisher badge means the publisher's identity has been verified and they have a compliance history in good standing.

Neither badge is a guarantee. Both raise the floor.

Also check whether the extension is open source with a public repository. It does not mean anyone has actually read the code, but it makes a hidden change far more likely to be noticed, and a developer who publishes their source has chosen to be accountable for it.

Why read the newest reviews rather than the best ones?

Sort the reviews by newest. This is where the single most common real-world failure shows up.

Extensions with real user bases get bought. A useful, well-behaved tool changes hands, and the new owner pushes an update that adds tracking, injects affiliate links into your shopping, or worse. That update installs automatically, silently, to everyone. The extension you vetted a year ago is not necessarily the extension running in your browser today.

The top-rated reviews are from the good years. The newest ones are where people say "this used to be great, then the last update added ads." That pattern — a long history of praise followed by a sudden cluster of complaints — is the clearest warning sign available, and it costs ten seconds to look for.

Two related things to notice:

• A large gap between the user count and the review count, or a wall of five-star reviews that are three words long and posted the same week, suggests inflated numbers.
• A recent change of name or description on a long-lived extension often accompanies a change of ownership.

Where does an extension send your data?

Chrome Web Store listings include a privacy section where the developer declares what data is collected and states whether it is sold to third parties or used for anything unrelated to the extension's core function. Read it. Developers are required to disclose, and a declaration that conflicts with the extension's stated purpose is a real finding.

Then ask two questions of your own:

Does it require an account? An account means a server, and a server means a copy of whatever you do with the tool exists somewhere outside your machine. Sometimes that is the entire point — sync across devices cannot work any other way. But for a tool that has no reason to need it, a required sign-up is a data collection decision dressed as a feature.

Does it work offline? If an extension keeps working with the network disconnected, its data is local. If it stops, your data is going somewhere. This is a crude test and a surprisingly informative one.

How do you narrow an extension's access after installing it?

Go to chrome://extensions, click Details on the extension, and change Site access from "On all sites" to "On click" or "On specific sites." Installing an extension is not the end of the decision, and this is the control most people never open.

The three settings are:

• On click — the extension only runs when you click its icon.
• On specific sites — you list the domains it is allowed to touch.
• On all sites — the default for broad permissions.

Moving an extension from "on all sites" to "on click" is the single best safety improvement available after installation, and for a lot of tools it costs you nothing, because you were only ever using them by clicking anyway. If an extension breaks under that setting, you have learned something real about how it works.

While you are on that page, turn on Developer mode briefly and note the extension IDs, or simply take stock: anything you do not recognise should go. And Chrome's Safety Check, in Settings, flags extensions that have been removed from the store or found to violate policy — worth running occasionally, because an extension pulled from the store does not necessarily vanish from your browser.

What are the signs that an extension is already misbehaving?

A search engine or homepage that will not stay changed, new tabs redirecting through an unfamiliar site, ads appearing on pages that do not normally carry them, and a sudden unexplained slowdown are the common signs of a misbehaving extension.

Any of these justify going through your extension list immediately:

• Your search engine or homepage changed and will not stay changed.
• New tabs redirect through a site you do not recognise.
• Ads appearing on sites that do not normally have them, or extra links inserted into pages.
• The browser is suddenly much slower, or pages stall on load.
• An extension you do not remember installing is present.

The response is to disable everything, confirm the symptom stops, then re-enable one at a time. If something was reading pages you care about, change the passwords for the accounts you used in that browser afterwards.

What standard should an extension meet before you install it?

A good extension does one job, works without an account, keeps its data on your device, asks only for permissions its feature needs, and still works when set to run on click. Those five properties are the standard worth applying, rather than a risk score.

The questions in full:

1. Does it do one job? Scope creep is how a utility acquires permissions it never needed.
2. Does it work without an account? If it does not need one, it should not ask.
3. Does the data stay on my device? Fewer copies elsewhere is fewer things to lose.
4. Does the permission it asks for match what it does?
5. If I set it to "on click", does it still work?

These are the rules I hold my own work to, so it is fair to check them against it. TabVault stores everything — saved tabs, categories, scroll positions, video timestamps — in your own browser on your own device. There is no account, no sync server, and therefore nothing held anywhere for someone else to lose. In a category where a lot of tools sync your entire tab history to a server by default, that is the specific thing worth verifying before installing anything, mine included. Do not take my word for it: the store listing states what it collects, and the "works offline" test takes ten seconds.

Are browser extensions worth installing at all?

Yes — the right extension for a task you repeat all day is one of the highest-leverage things in a browser. A good content blocker improves both safety and speed, and a password manager makes you more secure rather than less, so none of this caution is an argument against extensions as a category.

The argument is only for a minute of attention before the click, and an occasional clear-out afterwards. Fewer extensions, each doing one job, each scoped to what it needs, is both safer and faster than a toolbar full of things you installed once and forgot.

If you want the other half of the decision — not whether an extension is safe, but whether it will actually still be earning its place in a month — I have written that up separately in browser extensions that actually save time. And if the reason you are auditing your extensions is that everything has slowed to a crawl, start here instead.