The Browser Extensions Quietly Spying on You

I went through my own browser's extension list recently and found two I had completely forgotten installing, both with permission to read everything on every page I visit. That is a more common situation than most people realize.

One overlooked extension can quietly see everything a "secure" browsing session touches.

In this post

1. Why extensions are such a good spot to hide in
2. What "read and change all your data on websites" actually means
3. How legitimate extensions turn bad after the fact
4. The data that gets harvested most often
5. A short audit you can do in ten minutes

Browser extensions occupy an odd trust position. Installing one feels lightweight, almost disposable, compared to installing a full app on your computer or phone. But a lot of extensions ask for, and get granted, access to literally everything you see and type on every website you visit. That is a bigger ask than most people register when they click "Add to Chrome" for a coupon finder or a color picker.

Why extensions are such a good spot to hide in

Extensions run with a level of access that sits between "regular website" and "full application," and they tend to get far less scrutiny than either. Browser vendors review submissions, but automated review at the scale of hundreds of thousands of extensions cannot catch everything, especially behavior that only activates after an update, weeks or months after the initial approval. Combine that with how casually people install them, often on a whim to solve one small annoyance, and you get a category of software running with broad permissions and comparatively little ongoing oversight.

What "read and change all your data on websites" actually means

This is the permission Chrome and other browsers show for a large share of extensions, and it is worth taking literally. An extension with this permission can see the text on every page you load, including your banking dashboard, your email inbox, and any form you fill out, and it can modify what you see or inject its own content into the page. A legitimate password manager needs this level of access to autofill your credentials. So does most malware disguised as a browser extension. The permission prompt does not distinguish between the two, your judgment about the developer has to.

How legitimate extensions turn bad after the fact

One of the more uncomfortable realities here is that an extension does not have to be malicious at install time to become a problem later. A few patterns show up repeatedly:

• Ownership changes. A small, genuinely useful extension gets sold to a new owner, often specifically because of its existing user base, and a future update quietly adds data collection or ad injection that was never there before.
• Abandoned projects picked up by someone else. A popular extension whose original developer stops maintaining it can get taken over, sometimes by less scrupulous parties, through the extension store's account rather than anything the users chose.
• Silent auto-updates. Most browsers update extensions automatically and quietly, which is good for security patches but also means a behavior change can roll out to millions of users without anyone individually re-approving the new version's actual conduct.

Security researchers and browser vendors have documented this pattern repeatedly, including cases covered by the Electronic Frontier Foundation's Deeplinks blog, which tracks browser privacy issues as they come up.

A specific thing to watch for: an extension that suddenly starts showing you ads on sites that never had them before, or that changes your default search engine or new tab page without asking again, has very likely been compromised, sold, or updated to include new monetization you did not agree to. Remove it and do not wait to investigate first.

The data that gets harvested most often

Based on documented cases of extensions caught doing this, the most common targets are browsing history sold in bulk to data brokers, form data including names, addresses, and sometimes payment details typed into pages, and session cookies, which in the worst cases can let an attacker impersonate you on a site without ever needing your password at all. None of this requires a sophisticated exploit. It just requires a permission you already granted, being used for something other than what the extension's description implied.

A short audit you can do in ten minutes

1. Open your browser's extension management page and actually look at every single one, not just the icons pinned to your toolbar, since disabled or unpinned extensions still count
2. For each one, ask honestly whether you remember installing it and whether you still use it regularly
3. Check each extension's permissions directly, most browsers let you view this without reinstalling
4. Remove anything you do not recognize or no longer use, permissions do not expire on their own just because you stopped opening the extension
5. For the ones you keep, do a quick search for the extension's name along with the word "privacy" or "data" to see if anything has surfaced publicly

A reasonable middle ground

You do not need to run a bare browser with zero extensions to be reasonably safe. The goal is intentionality: know what is installed, know roughly why you have it, and remove things that have outlived their usefulness. A browser with three extensions you actually chose and understand is a far better security position than one with fifteen you cannot account for.

Extensions are genuinely useful, and most of them are not doing anything nefarious. The issue is not extensions as a category, it is the gap between how much access they are granted and how little ongoing attention most people give them after that first install click. A ten-minute audit every few months closes most of that gap.