A browser extension is a small software program you install directly into your web browser to change or add to how it behaves. Extensions can block ads, save passwords, translate pages, capture screenshots, check your grammar, or manage shopping coupons. Millions of Australians use at least one. The Chrome Web Store alone lists over 130,000 of them, and Firefox's add-on library isn't far behind. Most are genuinely useful. Some are genuinely dangerous.
How browser extensions actually work
When you add an extension to Chrome, Firefox, Edge, or Safari, it runs inside your browser as a small piece of JavaScript. It sits between your browser and every page you visit, which is precisely what makes it so powerful and so risky at the same time.
Extensions use a permissions system. When you install one, it tells you what it needs access to: "Read and change all your data on the websites you visit" is the broadest and most concerning. Others ask for narrower access, like "Read your browsing history" or "Communicate with cooperating websites." The problem is that most people tap through these prompts without reading them, the same way most people accept cookie banners.
Understanding what these small programs can see matters. An extension with full page access can, in theory, read every form you fill in, including passwords and credit card numbers. It can watch which pages you visit, capture text you type, and modify what appears on screen. That's not alarmist speculation. It's what the permissions actually allow.
This is closely related to how your browser handles other web technologies. If you've read about what cookies do inside your browser, you'll recognise a familiar pattern: a technology designed to help can be turned against you when it's built, updated, or acquired by someone with different intentions.
Why extensions go bad
Most extensions start honest. The problem is what happens next.
A developer builds a useful extension, grows it to 500,000 users, then sells it. The buyer isn't always interested in the product. Sometimes they want the distribution: hundreds of thousands of browsers they can now push silent updates to. Researchers at the University of California Berkeley documented this pattern extensively. An extension that was safe on Monday can become data-harvesting spyware by Thursday, with no visible change for the user.
There are three common ways extensions turn harmful:
- Acquisition: a legitimate extension is sold to a new owner who injects malicious code via an update.
- Compromise: a developer's account is hacked, and attackers push a poisoned update to the existing user base.
- Built bad from the start: a free tool disguises adware, tracking scripts, or credential theft behind a genuinely useful feature.
Google and Mozilla both review extensions before listing them, but neither can guarantee safety after publication. Automatic updates mean users rarely see what changed between versions.
How to tell if an extension is trustworthy
The number of users and stars in a store listing tells you something, but not everything. A rating can be gamed, and a large user base only tells you the extension was once popular. Here's what to actually check.
First, look at the publisher. An extension from a company you've heard of, with an identifiable website and a public support channel, carries less risk than one credited to "Admin" with no web presence. Second, read the permissions carefully. If a currency converter is asking to "read and change all data on all websites," that's disproportionate. A currency converter needs to know the page content in some cases, but rarely all of it. Third, check when it was last updated. An extension that hasn't received an update in two years is either abandoned or dormant. Either way, it's a security debt.
Strong browser security doesn't stop at extensions. Tools like firewalls and two-factor authentication protect your network and accounts at a deeper level, but they can't compensate for a malicious extension running inside your browser session with your own credentials already active.
The permissions audit: what to do right now
Open your browser's extension manager. In Chrome, type chrome://extensions into the address bar. In Firefox, it's about:addons. You'll see everything installed, including extensions you've forgotten about.
For each one, click "Details" and review what it can access. Ask yourself two questions: do I actually use this, and does the access it demands match what it actually does? If either answer is no, remove it. Fewer extensions means a smaller attack surface. That's not a complicated trade-off.
It's also worth checking the Chrome Web Store listing for any extension you're unsure about, even if you've had it installed for years. Read the most recent reviews and look for any mention of unexpected behaviour. Users tend to notice when an extension starts doing something it didn't used to do.
Extensions worth keeping versus those worth ditching
Some categories of extensions carry consistently low risk. A well-known ad blocker from a verifiable nonprofit or developer (uBlock Origin from Raymond Hill, for instance) has a public codebase and an active community scrutinising every update. Password managers from established companies like Bitwarden or 1Password are similarly accountable.
Higher-risk categories include free VPN extensions, shopping assistant tools that inject coupon codes, and anything that promises to "boost" browser speed or internet connection. These categories attract malicious developers specifically because the use case justifies broad permissions, and users expect some level of background activity.
The safest approach is a short list. Keep the extensions you actually use weekly. Remove anything you haven't clicked in a month. Treat each one as a piece of software running with access to your entire browsing session, because that's exactly what it is.