An extension asks for your trust once, and then you forget about it. That small icon beside the address bar can read every page you open, watch what you type into forms, and quietly send data to a domain you have never heard of. Most extensions are exactly what they claim to be. The trouble is the handful that aren't, and the ones that were fine until somebody bought them. A proper audit takes about twenty minutes and needs no special tools.
Start with an honest inventory
Open your browser's extension manager by typing the address yourself: chrome://extensions in Chrome and Brave, edge://extensions in Edge, about:addons in Firefox. There is no menu shortcut worth memorising.
Now scan the list slowly and note anything in these categories:
- Extensions you cannot identify, or whose names look like generic utilities ("Quick Search Plus", "Smart Savings").
- Anything tagged as installed by an organisation or added by another program. These were pushed onto your browser by something else, and they rarely show up in the normal install flow.
- Add-ons you installed for one task three years ago and never removed.
- Extensions that duplicate each other. Two ad blockers do not give you double protection; they give you double the data access and a slower browser.
PDF viewers, coupon finders, screenshot tools and "driver updaters" bundled with desktop software are the ones worth suspecting first. They arrived without a clear decision on your part, which is exactly the profile an audit is meant to catch.
Read permissions as capabilities, not intentions
In Chrome, click Details on a single extension. In Firefox, open the add-on and look at the Permissions and Data tab. Ignore the marketing copy on the store page and read this instead, because it describes what the code can technically do.
The ones that matter most:
- Read and change all your data on all websites — full page access. It can read text, inject buttons, and capture anything typed into a form on any site you visit.
- Read your browsing history — a map of everything you look at, including the embarrassing searches.
- Read and modify data you copy and paste — clipboard access. Password managers legitimately need this; games and weather widgets do not.
- Manage your downloads, read and change your bookmarks, display notifications, access your tabs — each is a small leak on its own, a serious one in combination.
- Native messaging or debugger — rare and powerful. A mainstream extension should almost never request these.
Then match the permission to the job. A dark mode extension genuinely needs page access on every site. A screenshot tool needs it only when you click. A currency converter needs almost nothing. If a tool could do its work with site access set to On click rather than On all sites, change that dropdown right now — the extension keeps working, and you stop handing it a permanent key.
Check the update history and who owns it now
Popular extensions get sold. The store listing keeps the name and the user count, but the code and the incentives change hands. Scroll to the bottom of the Chrome Web Store page, or the version section in Firefox, and read the recent changes.
Warning signs worth acting on:
- Years without updates, followed by a new version that suddenly requests more permissions.
- A publisher name that differs from the one you remember, or a listing that has been rewritten to sound like a different product.
- Recent reviews mentioning injected ads, changed homepages, or "this used to be good".
If an update asks for new permissions, that is the moment to decide — not after you have clicked through the prompt out of habit.
Newer versions of major browsers disable extensions that gain permissions until you re-approve them. Treat that dialog as a real warning, not an inconvenience. If you did not need the new capability, remove the extension and find an alternative.
Watch what it actually does
Declared permissions tell you what is possible. Behaviour tells you what is happening. Create a fresh browser profile, install only the extension you are auditing, and use the browser normally for ten or fifteen minutes on sites you genuinely visit.
Open DevTools with F12 and watch the Network tab. Requests to the extension's own API, its update server, or a payment processor are expected. Requests to an unidentified analytics or "data" domain in the middle of ordinary browsing are not. Look for large blobs being posted rather than small configuration fetches.
If you want to go further, open chrome://extensions, click Details on the extension, and look for the service worker link. That opens DevTools attached directly to the background script, where you can see its own network calls and console errors. Firefox offers the same through about:debugging#/runtime/this-firefox.
You do not need to read minified code line by line. Skim the manifest.json instead: download the extension package, rename the file to end in .zip, extract it, and open that file. It lists the declared host permissions, which are often broader than the summary the browser shows you.
The five-minute triage
Run every installed extension through these questions in order. One "no" is a reason to remove it; two is a reason to remove it today.
- Have I used this in the past month?
- Do its permissions match what it does for me?
- Was it updated recently, and by the same publisher I originally installed?
- Does it run on sites where it has no business running?
- Did I see network traffic I cannot explain?
- Does another extension already cover this job?
Removing it without leaving a mess
Click Remove, then restart the browser completely. A restart matters because some extensions keep a background process alive until every window closes.
Then clean up the parts that do not disappear automatically. Sign out of and back into sensitive accounts if the extension had access to cookies or page content, and rotate passwords for anything critical if you suspect data was being collected. Turn on two-factor authentication where you have not already — it limits the damage from credentials you cannot be sure about. Check whether a companion desktop application was installed alongside the extension; it will re-add the extension if you leave it running.
If an extension reappears after removal, look at chrome://policy or your operating system's device management settings. Something outside the browser is enforcing it. On a work machine, that is a conversation with IT rather than a fight you can win.
Make it a habit
Once a quarter, open the extensions page and remove one thing you no longer use. Keep a separate profile for coupon finders and shopping helpers so they never see your banking session. Set site access to On click wherever the extension still functions that way, and read the permission prompt on updates instead of dismissing it.
Your browser is the front door to almost everything you do online. Twenty minutes twice a year is a small price for knowing who else has a key.
Photo: Caio / Pexels
