Most extensions are fine. Some are not, and the failures are instructive.

When good extensions go bad

Extensions get sold. A developer builds a useful tool, gains a million users, gets tired of maintaining it or gets an offer, and the new owner quietly pushes an update that turns the trusted helper into a data collector. This isn’t hypothetical: in recent years, data-collection code has been found in extensions with millions of combined installs after changes of ownership. The extension you vetted last year is not necessarily the extension running today.

Others start bad: lookalike extensions that copy the name and icon of a popular ad blocker and sit in the store waiting for searches, or “free VPN” extensions whose business model is your browsing history. Chrome’s store cleaned out a batch of malicious extensions carrying malware as recently as 2025; the mechanism is a permanent feature of how extensions are distributed, not a one-off scandal.

What an extension can actually see

When you click “Add to Chrome”, the store shows a permission list. The fateful one is “Read and change all your data on all websites”. With that permission, an extension can read every page, every form field, and inject or rewrite content. Some extensions genuinely need this (a full ad blocker must see pages to filter them). A recipe converter or a dark-mode toggle usually doesn’t.

Match permissions to function. An extension asking for far more than its job requires is telling you something.

The five worth having (a short list, on purpose)

• uBlock Origin — open-source content blocker; blocks ads and the tracking scripts that ride in with them. Effectively a privacy upgrade in one move.
• A password manager (Bitwarden, 1Password) — fills passwords only on the exact matching site, which doubles as phishing protection.
• Decentraleyes — serves common library files locally instead of phoning third-party CDNs on every page load.
• Privacy Badger (if not using uBlock Origin — pick one, not both) — learns which trackers follow you across sites and blocks them.
• Nothing else, unless it earns its place. That’s the point of this list.

How to vet an extension in two minutes

1. Count the users and read the recent reviews. A million users with 4.6 stars is a different risk from 3,000 users and a nice screenshot. Sort reviews by newest and look for complaints about redirects, popups, or “why is my CPU busy”.
2. Check the developer. Same name as the well-known product? Different letter count? Close enough to be a trap? Check the developer’s other extensions.
3. Read the permissions. Does a theme need to read website data? It doesn’t.
4. Check the last update. Abandoned extensions rot, and unpatched extensions become attack surface.
5. Install from the official store only (Chrome Web Store, Firefox Add-ons, Edge Add-ons), never from a website’s “download our extension” link.

Audit the toolbar you already have

Open your extensions page (Chrome/Edge: the puzzle-piece icon → Manage extensions; Firefox: about:addons) and apply the standard we’ve been describing all along: if you don’t remember installing it, remove it. If you haven’t used it in a month, remove it. If it’s a duplicate of something else, remove one. Every extension is code running with page-level access, and the pile grows one “sure, why not” at a time.

In an office, extensions are a policy question more than a personal one: one compromised extension on one machine that handles client data is enough. We keep extension policies locked down for managed-support clients, so the pile doesn’t grow by accident.

Related guides

• Browser privacy settings that actually do something
• How to spot phishing emails and fake websites
• Secure your home WiFi: 7 weak spots to fix