Internet & Web
A calm guide to using browser extensions safely, covering permissions, trusted sources, and the simple habits that keep your browsing private and secure.
Browser extensions are the most privileged software you install without thinking about it: a single extension with "read and change all your data on all websites" can see your bank balance, read your email, and capture what you type into any login form. Safe use comes down to three habits — install only from official stores, read the permission request before you click Add, and restrict site access afterward — plus knowing why an extension you have trusted for years can suddenly turn hostile.
Every Chromium extension (Chrome, Edge, Brave, Opera) and every Firefox add-on declares its permissions in a manifest file, and the browser shows them to you in plain language the moment you click "Add." That box is the single most important safety check you get, and most people click through it in under a second.
The line to watch for is "Read and change all your data on all websites you visit." In the manifest that is the <all_urls> host permission, and it is exactly what it sounds like: the extension can read and rewrite the content of every page, including your webmail, your bank, and any form you submit. Plenty of legitimate tools genuinely need it — ad blockers, password managers, and full-page translators cannot work without seeing page content. The problem is that the same permission is indistinguishable, to you, whether it powers uBlock Origin or a wallpaper changer that has no business reading your Gmail.
Other requests are narrower and easier to judge. "Read your browsing history" feeds tab managers and session tools. "Manage your downloads" suits download managers. The activeTab permission is the safest of all — it grants access only to the current tab, and only when you click the extension's icon, so a screenshot tool built on activeTab cannot watch you in the background.
Match the power to the purpose. A theme or a colour picker asking to read data on all sites, or a unit converter that wants your browsing history, is a mismatch, and mismatch is the clearest warning sign you will ever get. When the request is broader than the job, decline and find an alternative — there is almost always another tool that does the same thing with less reach.
Install from the Chrome Web Store, Microsoft Edge Add-ons, or Firefox Browser Add-ons (addons.mozilla.org, known as AMO), and nowhere else. These stores run automated and human review and can pull a bad extension from every user's browser remotely. A .crx file offered by a blog, a "download" button in a search ad, or an email link skips all of that — and Chrome will warn you that extensions installed outside the store may be unsafe, because sideloading is the classic malware route.
The store is not a guarantee, so a few checks help. Look at the user count, not just the star rating — ratings are easy to inflate with fake reviews, but a genuinely popular tool usually shows six or seven figures of users and years of history. Confirm the developer: the real uBlock Origin is published by Raymond Hill, and the real Bitwarden by Bitwarden, Inc. Clones are a real hazard — a well-known ad blocker or password manager will have imitators with near-identical names and icons, hoping you install the wrong one. The safe route is to go to the maker's own website and click their link into the store, rather than searching the store and guessing.
The most dangerous myth is "it has been fine for years, so it is safe." Extensions change hands, and they update silently. A developer can sell a popular extension to a new owner, who then pushes an update that turns a useful tool into spyware — and because the extension already holds broad permissions, no new prompt appears.
This has happened repeatedly and at scale. The Great Suspender, a tab-saving tool with roughly two million users, was handed to an unknown party in 2020; the new owner added tracking code, and Google force-removed it from every browser in early 2021. The Stylish extension was pulled from the Chrome and Firefox stores in 2018 after it was found recording every site users visited and tying that history to their accounts. Nano Adblocker and Nano Defender were sold in 2020 and updated to harvest session data. The pattern is always the same: a trusted tool, an ownership change, a silent update.
You cannot audit source code, but you can react to signals. If an update suddenly requests new permissions — especially "read and change all your data on all websites" on a tool that never needed it — stop and investigate rather than clicking accept. Chrome's Safety Check (open chrome://settings/safetyCheck) now flags extensions that were removed from the Web Store for policy violations, which is often the first public sign that something went wrong.
You do not have to accept an all-sites extension's full reach. Both Chrome and Firefox let you clip its wings after install.
Chrome / Edge: open chrome://extensions (or edge://extensions), click Details on the extension, and find Site access. Change it from "On all sites" to "On specific sites" (list only the ones it needs) or "On click," which makes the extension run only when you click its icon. A price tracker you use on two shopping sites has no reason to run on your banking tab.
Firefox: open about:addons, click the extension, and use the Permissions tab to toggle host access and switch it to run only when clicked.
This one habit neutralises most of the risk of a broad permission, because even a compromised extension can only act where you have allowed it.
Every extension is code the browser runs and trust you have extended, so fewer is safer and faster. Every few months, open your extensions page and remove anything you installed for a one-off task, no longer recognise, or that is no longer maintained — the store listing tells you when it was last updated.
One current wrinkle is worth understanding. Chrome has moved to Manifest V3, disabling older Manifest V2 extensions across 2024 and 2025. MV3 replaced the old blocking webRequest API with declarativeNetRequest, which caps how many filtering rules an ad blocker can use. That is why uBlock Origin's maintainer released a separate uBlock Origin Lite for MV3 Chrome — it is the legitimate successor there, not a clone. Firefox still supports the more capable MV2-style blocking, which is one reason privacy-focused users keep a Firefox install around.
Not inherently. Price says nothing about how an extension handles your data — some of the worst offenders were free tools that monetised by selling browsing history, and plenty of excellent extensions are free and open source. Judge by permissions, developer reputation, and user base, not the price tag.
Yes, from a reputable maker — the 1Password, Bitwarden, and Dashlane extensions are widely used and audited, and the convenience of autofill genuinely improves security by encouraging unique passwords. They legitimately need broad page access to fill fields. The rule is to install only the official extension from the vendor's own site and enable two-factor authentication on the account.
Disable your extensions one at a time and watch when the odd behaviour stops. New adverts, searches routed through a service you never chose, or unexpected redirects are classic signs of a compromised or ad-injecting extension. Open your extensions page, turn them off individually, and remove the one that fixes it for good.
Some do while it is open. Background service workers can run tasks even when you are not actively using that extension, though they stop once the browser is fully closed. That is another reason to restrict site access and keep the list short — the fewer background components running, the smaller the surface for something to go wrong.
Priya translates the fast-moving world of AI and the internet into things you can actually use and understand. She's curious but skeptical, quick to separate genuine progress from hype, and keen to help readers use new tools wisely rather than fearfully.
Keep reading
A crowded inbox drains attention all day. Here is a calm, repeatable system to clear the backlog and keep your email tidy without living inside it.
Priya Nadar
Forgotten subscriptions quietly drain money every month. Here is a calm, practical way to find every one of them, cancel cleanly, and keep the list short.
Priya Nadar