Before You Install a Browser Extension: A Checklist

Extensions can read and change almost anything your browser sees. Run through this checklist before you click Add, and use it to review the ones you already have.

This guide is general information, not technical or legal advice. If you’ve lost money or personal information, contact your bank, IDCARE on 1800 595 160, or report it through ReportCyber at cyber.gov.au.

Quick summary

1. A permission warning doesn’t mean an extension is dangerous, just that it could be, so read every warning and judge each one on its own.
2. The broadest permission lets an extension read and change everything on the pages you visit, including passwords and card numbers typed into forms.
3. Check the publisher’s explanation of its permissions; developers are advised to request only what they need and explain why in the listing.
4. Popularity is a weak safety signal. An audit of ten popular Chrome extensions found eight requested the broadest permission, with four of those monetising data.
5. Review your installed extensions in the browser’s add-ons manager and remove anything you don’t recognise or no longer use.

A browser extension takes two clicks to install, and unlike an ordinary app it can sit quietly inside every page you visit. Because of that privileged position, the install prompt deserves a proper read rather than the usual click-through. This checklist covers what to look at before you add an extension to Chrome, Edge, Firefox or Safari, and how to keep the ones you already have under control.

Why extensions deserve more caution than apps

An extension is a small program that adds a feature to your browser: ad blocking, note taking, grammar checking, password storage. To work, many need broad access to what the browser sees, and the browser sees a lot: your history, the tabs you open, the forms you fill in and the passwords you type. Google’s own guidance is candid about the install warning: it doesn’t mean the extension is dangerous, just that it can be.

The habits that protect you when installing phone apps apply here too. Our guide to downloading apps safely walks through checking a publisher and a listing before you install. Extensions add one more thing to read: the permission list.

Read the permissions list before you click Add

Chrome, Edge and Firefox all show a dialog listing what the extension can access, and Safari shows similar detail on the store listing. Work through it item by item:

• Read every line, not just the first. Each warning describes a separate capability, so judge them one at a time rather than reacting to the overall impression.
• Take “read and change all your data on websites you visit” seriously. This is the broadest access available. The extension can see and alter anything on the pages you open: passwords, card numbers, messages and form entries. Ad blockers and password managers genuinely need it, because a password manager has to find login fields on whichever site you use it on.
• “Your tabs and browsing activity” means the URLs and titles of every page you visit. It also lets the extension open and close tabs and move them to new pages.
• “Your browsing history” lets the extension read and erase your history.
• “Your bookmarks” lets it read, change and add to your bookmarks.
• “Data you copy and paste” is exactly what it says. Anything you copy, including text from a banking page, becomes readable.
• “Your physical location” gives it the current location of your device.
• “Your list of installed apps and extensions” lets it enable, disable, uninstall or launch your other extensions and themes.
• Prefer extensions that use optional permissions. Some ask for extra access only after installation, when you switch on a specific feature, which keeps their everyday access lower.

Who made it, and how to check their track record

The permission list tells you what an extension can do. The publisher tells you how likely it is to do something you would regret.

• Look for an explanation of the permissions in the store description. Developers are advised to request only what they need and to explain their reasons. If a listing is silent on why a grammar checker must read every page, treat that silence as an answer.
• Check the developer’s other work. A publisher with a website, a support contact and a small set of related extensions is easier to judge than an anonymous one.
• Watch for copycats. Attackers spoof legitimate extensions, building fraudulent versions to trick people, and fakes have slipped into official stores before. Compare the developer name, spelling and icon against the official listing.
• Check that it is maintained. Regular updates suggest the developer is still paying attention; see our guide to software updates for why staying current matters.

What reviews and user counts can and can’t tell you

Store popularity is a weak signal on its own. Use it as a starting point, not a verdict.

• User counts show popularity, not safety. One count put the Chrome Web Store at about 112,000 extensions in August 2024, with other trackers listing up to roughly 145,000. That scale is exactly why the ecosystem attracts attackers.
• Read the recent low-star reviews first. Complaints about new ads, surprise permissions or odd behaviour usually surface there before anywhere else.
• Don’t dismiss extensions with few reviews out of hand. New and niche tools simply haven’t had time to collect them; judge the publisher instead.
• Don’t treat popularity as proof of restraint. The audit above covered widely installed extensions, and most of them still asked for the broadest access available.

Free versions, ads and data collection trade-offs

Most extensions cost nothing up front, but something pays for the development time. Work out what before you install.

• Identify the business model. Advertising, paid upgrades and data collection are the usual three. Free is a fair price only when you’re comfortable with the funding.
• Check what the listing says about data handling, and what it doesn’t. If an extension can read every page and the listing says nothing about your data, the missing explanation is the trade-off.
• Consider paying for tools that handle sensitive information. If an extension will watch your logins and card entries, a modest cost can be a cleaner arrangement than one funded by advertising.
• Weigh shopping and coupon tools carefully. They often need to read shopping pages to work, and the audit findings about data monetisation are a reason to read their listings closely.

What an extension can read on every page

Many of the warnings above trace back to one thing developers call host permissions: a pattern of web addresses the extension may interact with. A pattern can match a single site or every site. When an extension can inject code into a page, the browser has no way to tell what that code will do, so it warns you about the worst case. That is why the broad warning sounds alarming even for legitimate tools.

• Ask what the extension actually needs to see. A tool that works on one shopping site can be built to match that address alone; it doesn’t need every page you visit.
• Check whether access is all or nothing. Extensions that hold extra permissions back until you enable a feature give you a lower level of everyday access.
• Review your website permissions separately. In Chrome, Privacy and security, then Site settings, shows what individual sites may do, including camera, microphone and notification access, quite apart from your extensions.

How to review and remove the extensions you already have

The checklist also applies backwards, to what is already installed. Every major browser has an extensions or add-ons manager that lists everything.

• Open the extensions or add-ons manager. You’ll find it in the browser’s main menu, and it lists every installed extension in one place.
• Check the permissions on each entry. Browsers such as Firefox let you inspect an extension’s privileges after installation; look for a details or permissions link on the listing.
• Remove anything you don’t recognise or no longer use. Permissions exist partly to limit the damage if an extension is ever compromised by malware, so fewer extensions with narrower access works in your favour.
• Re-read the permissions after an update. Permission warnings can appear when you install or update an extension, so an update is a natural moment to check nothing has crept in.

If you have five minutes spare today, open your browser’s extensions page and read the permissions on everything listed there.

Your questions answered

Q: What does "read and change all your data on websites you visit" actually allow?

A: The extension can see and alter anything on the pages you open, including passwords, card numbers and messages. Legitimate tools such as ad blockers need this, but a malicious extension with the same access could capture everything you type.

Q: Are optional permissions better than ones asked for at install?

A: Usually, yes. Extensions with optional permissions collect less access up front and only ask when you turn on a feature that needs it.

Q: How do I remove an extension I no longer want?

A: Open your browser’s extensions or add-ons manager, find the extension and choose remove. Taking out extensions you no longer use shrinks what can go wrong later.

Q: Do I need to check permissions again after an extension updates?

A: It’s worth doing. Permission warnings can appear when you install or update an extension, so an update is a good moment to confirm nothing new was added.