Browser extensions are small programs with a lot of access. A good one saves you time every day. A careless or malicious one can read the pages you visit, change what you see, or quietly collect data. The good news is that you can judge most extensions in a couple of minutes if you know where to look. This checklist is written for Chrome and other Chromium-based browsers (Edge, Brave, Opera, Vivaldi), but the same ideas apply to Firefox.
Why extensions deserve attention
When you install an extension, you grant it permissions. Some are harmless, such as storing its own settings. Others are powerful: "Read and change all your data on all websites" means the extension can see the content of every page you open, including web mail and online banking pages, and modify it. Many legitimate tools need exactly that permission to work (ad blockers, translators, password managers), so the warning alone is not a red flag. It means you should trust the developer.
Before you install: a two-minute checklist
1. Read the permission warning
Chrome shows the key permissions in a dialog when you click Add. Ask yourself whether each permission makes sense for what the extension does. A page translator needs access to the pages you translate. A calculator does not need access to every website, your browsing history or your downloads.
2. Check the developer
On the Chrome Web Store listing, look at who publishes the extension. A named company or developer with a working website, a support email and a privacy policy is a better sign than an anonymous account. Some developers carry a verified badge, meaning the store has confirmed their identity.
3. Read the privacy section
Chrome Web Store listings include a Privacy practices section in which the developer declares what data the extension collects and states that it is not sold to third parties. Compare this with the permissions: an extension that asks for access to all websites but claims to collect nothing should explain why it needs that access.
4. Look at reviews, users and updates
- Recent reviews matter more than the average rating. A sudden wave of complaints about ads, redirects or new behaviour often means something changed, sometimes after the extension was sold to a new owner.
- User count is a weak signal on its own, but an extension with very few users and very broad permissions deserves extra caution.
- Last updated date: an extension that has not been updated in years may not follow current browser security rules.
5. Install from the official store
Avoid installing extensions from download sites or by loading files manually unless you are a developer testing your own code. Store extensions are reviewed and can be removed remotely if they turn out to be malicious.
6. Beware of copycats
Popular extensions attract imitations with similar names and icons. Check that the developer name and website match the product you are looking for, especially for password managers, crypto wallets and ad blockers.
Limit what an installed extension can see
Chrome lets you restrict where an extension runs, even if it asked for access to all sites:
- Open chrome://extensions (or Menu → Extensions → Manage Extensions).
- Click Details on the extension.
- Under Site access, choose On click (it runs only when you click its icon), On specific sites (you list the sites) or On all sites.
For a tool you only use on one or two sites, "On specific sites" is a simple way to reduce risk without losing anything. You can also turn off Allow in Incognito for extensions you do not need in private windows.
Clean up what you already have
Most people have extensions they installed once and forgot. Every one of them still runs, uses memory and holds its permissions. Once or twice a year:
- open chrome://extensions and remove anything you do not recognise or no longer use;
- turn off extensions you use rarely and switch them on only when needed;
- check the Site access setting of the ones you keep;
- run Safety Check in Chrome settings (Privacy and security), which can flag extensions that have been removed from the store as harmful.
Warning signs after installation
- your search engine or new tab page changed without you choosing it;
- new ads, pop-ups or redirects appear on sites that did not have them;
- the extension asks for new permissions after an update (Chrome disables it until you approve them);
- the browser became noticeably slower after installing it.
If you see any of these, disable the extension first and check whether the problem disappears. If it does, remove the extension. If odd behaviour continues, use Settings → Reset settings in Chrome to restore the defaults.
The bottom line
Broad permissions are normal for many useful extensions, so the real question is whether you trust the developer. Check the permissions, the publisher, the privacy section and recent reviews before installing, limit site access where you can, and prune your list regularly. It takes a few minutes and removes most of the risk.