I have been on the wrong end of an extension decision more than once. The pattern is always the same. I install something small on a tired afternoon, the install screen flashes too fast to read, and the add-on sits quietly in the background for weeks. Sometimes months. Then one morning a security newsletter mentions a fresh wave of compromised add-ons, and I go look at my own list and find two I cannot remember installing and one I definitely do not want anymore. None of them were malware. All of them were a small mistake I made by not reading the install screen when I had the chance.
The browser is the most privileged piece of software on most computers. It holds active sessions, saved cookies, your password manager state, your form history, and whatever you have copied to the clipboard. An add-on with broad permissions sees all of that on every page you visit, including the ones where a leak would do real damage. The browser equivalent of installing a sketchy add-on is closer to giving a stranger your house keys than to installing a phone app. The phone app lives in a sandbox. The browser add-on does not.
Why the install screen is worth reading
Chrome and Firefox both surface the permissions an add-on is asking for at install time, and almost nobody reads them. The permissions matter, so here is a translation from corporate lawyer into plain English. The single most powerful entry in the list is the one that says the add-on can read and modify every page you load. That covers login screens, form fields, and anything else rendered in the tab. If a tool asks for this, the question is not “do I trust this developer” but “does this tool genuinely need to read every page I open, or is it asking because that is the easiest path through the Chrome API.” The first answer is fine for password managers and ad blockers. The second is your cue to walk away.
A second permission worth pausing on is anything that asks to read or change your cookies. Session cookies are the little tokens that keep you signed into Gmail, your bank, your cloud drive, and everything else. An add-on with cookie access can impersonate you on those sites without ever asking for your password. A third is the broad “access your tabs and browsing activity” permission, which gives the add-on visibility into what URLs are open right now and a way to inject scripts into the pages. Useful primitive for a tab manager. Dangerous primitive for anything that does not have an obvious reason to know what you have open.
A short glossary worth keeping open in a tab while you install things:
- Read and modify every page you load: full access to form fields and login screens, the strongest permission in the list
- Access your tabs and browsing activity: knows your open URLs and can run code in those pages, fine for tab managers, sketchy for everything else
- Manage your cookies: the session cookies that keep you signed into sites. With this, an add-on can act as you without your password
- Access storage or clipboard: anything you copy, paste, or save locally is potentially visible to the add-on
Firefox ships more locked down by default. Chrome lets some add-ons run in site-scoped or click-to-run modes. Use whichever one your browser offers, especially for anything that only needs to act on one or two sites.
The store is a distribution channel, not a vetting service
Both major stores run automated checks and a layer of human review, and both have tightened their rules since the malicious add-on waves of 2018 and 2020. Google has put real work into making the Chrome Web Store harder to abuse. None of that turns the store into a vetting service. It makes the store a place where most add-ons are fine, some are not, and you still have to look.
The clearest recent example of how fast that can turn serious is the December 2024 Cyberhaven breach. Cyberhaven was a legitimate data-flow tracking tool used by corporate security teams. Attackers compromised the developer’s publishing account and slipped a malicious update through Chrome’s review process that quietly exfiltrated session cookies and authentication tokens from every browser that auto-updated overnight. Users had already vetted the legitimate version, so the bad code landed inside a tool they trusted. A 2025 academic study followed up by showing that malicious add-ons had repeatedly cleared both Chrome and Firefox review and were sitting in the stores with tens of thousands of installs. A separate July 2025 investigation pulled eighteen flagged add-ons out of the Chrome Web Store, some of them on the first few pages of search results. The lesson is not that the stores are useless. The lesson is that “available in the official store” is roughly the security level of “downloaded from a website I have not heard of,” not the level of “audited by a security team.”
A five-minute routine that catches the bad ones
When an add-on crosses my radar, I run five checks that take roughly five minutes total. None of them are perfect. Together they catch the bad ones before I install them.
Start by looking at the publisher. Is there a real company or a recognizable open source project behind the add-on, or is the publisher an anonymous Gmail address with no footprint anywhere else? Search the publisher name plus the word “incident” or “breach” and see what surfaces. Most legitimate publishers have either a clean record or a well-documented postmortem from a past problem they handled responsibly. Anonymous publishers with no public history are higher risk by default, not because anonymity is itself a problem, but because there is no one to hold accountable if the add-on pivots.
Then read the recent reviews, not the average rating. Average rating on the Chrome Web Store is essentially meaningless as a signal. The most recent thirty days of reviews will tell you whether the add-on is in active development, whether anyone is complaining about sudden permission changes, and whether anyone is reporting odd network activity in their browser console.
Check the install count and the last update date. A brand-new add-on with a hundred installs and no recent updates is a different risk profile than one with a million installs and active development. Neither is a deal-breaker on its own. Both are worth noticing.
Cross-check the permissions against the actual feature. If a to-do add-on asks for the ability to read every website you visit, or a dark-mode toggle asks for clipboard access, the mismatch is the answer. Mismatches almost always mean the add-on is doing something it is not telling you about, and the only way to know what that is without reading the source is to walk away.
Finally, check whether the add-on is open source. A GitHub link in the listing, or a project page on the publisher’s site, lets you or someone you trust actually read the code. Closed source is not automatically bad, but open source is verifiable, and verifiable is better when the add-on has access to your banking session.
If the add-on fails any of those checks, skip it. There is almost always an alternative.
A small category worth going further on
There is one group of add-ons that deserves more than a five-minute check. Password managers are the obvious example. So is anything that reads form fields on banking or email sites, anything that handles authentication tokens, and anything that reads data on every site you visit by design. For those, a heavier approach is justified. Some can be replaced with a self-hosted alternative. Some can be forked from a public repository, audited by you or by someone you trust, and loaded as unpacked developer add-ons in Chrome or Firefox. That is a real maintenance commitment and you should make it with eyes open. The point of taking that on is to remove a single point of failure from your own security setup. That trade is real. It is also worth it for the categories that actually touch your most sensitive data, and only for those.
For everything else, the five-minute routine above is plenty.
Trade-offs
Vetting takes time, and going deeper on the sensitive categories takes more time and some comfort with developer tools. Most people will not do either for every add-on they install, and that is honest. The point is not paranoia. The point is to put the vetting budget where the risk is highest, which is the add-ons that touch passwords, authentication, and the form fields on banking sites. Start there. The rest can wait.
Coach’s note
Pick a Saturday morning. Open your browser’s add-on list. Run the five-minute check against anything with access to banking, email, or your password vault. Uninstall the failures and replace them with alternatives you can name. Then close the list and go do something else. The five minutes is the only time investment that scales across every add-on you will ever install, because the cost of being wrong compounds silently in the background while you do everything else.
Source: https://fosspost.org/why-you-should-self-host-or-vet-every-browser-extension-you-install/
Verification token: EDLJX-20260902-124507-25340-0