Security Malware and cleanup: when a device starts misbehaving
Browser extensions: the permission that reads every page
Why a small extension can see everything you do online, how good ones turn bad after being sold, and the audit that takes five minutes.
The short answer
- An extension that can read and change all your data on all websites can see your webmail, your bank and everything you type, because extensions run inside the pages you open.
- Session cookies are the real prize, since a stolen cookie lets someone resume your signed in session without your password or your second factor.
- Popular free extensions get bought, and the new owner can change behavior through a silent background update without any new permission prompt.
- Setting an extension to run on click or only on named sites converts constant access into occasional access and is the highest value setting on the page.
- Remove rather than disable, and after removing a bad one, sign out of all devices so any stolen session token stops working.
When you install a browser extension, the line that matters is the one most people click past: read and change all your data on all websites. That single permission is not a mild convenience. It lets the extension see every page you open, including your webmail, your bank and your work systems, read what you type into them, alter what they show you, and in many cases read the session cookies that keep you signed in. Extensions are not sandboxed away from your browsing the way apps are sandboxed on a phone. The useful ones earn that access. The problem is that nothing about the install prompt tells you which ones those are.
What read and change all your data actually allows
An extension with that permission runs its own code inside every page you load, in the same place the page's own scripts run. Concretely, it can read the full text of a page after you are signed in, capture keystrokes in a form, insert or remove elements so the page shows something different, watch every address you visit, and send any of it to a server of its choosing.
The part people underestimate is session cookies. Your password is not what keeps you signed in: a cookie is. An extension with cookie access can copy that token, and whoever holds it can resume your logged in session from their own machine without your password and without triggering your second factor, because the sign in already happened. That is why two factor authentication is not a complete answer here, and why the advice to sign out of everything and change passwords after removing a bad extension includes signing out of all devices, which invalidates the stolen cookie.
None of this requires a bug or an exploit. It is the permission working as designed. An extension that blocks ads, checks grammar or manages tabs genuinely needs to see page content to do its job, which is exactly why the permission exists and why it is such a good hiding place.
How a good extension turns bad
The most common route to a harmful extension is not a fake one you were tricked into installing. It is a real one you chose years ago, which changed hands. A developer with a popular free extension and no revenue is an obvious target for an offer, and the buyer is sometimes a data broker or an ad injection outfit. The purchase includes something valuable: an installed base that already granted broad permissions and a listing with years of good reviews.
What happens next is quiet. Extensions update themselves in the background, with no prompt and no release notes. If the new owner works inside the permissions the extension already had, you are never asked to approve anything, because you approved it in the original install. Browsers only interrupt when an update asks for something new, and an extension that already reads all sites has nothing left to ask for.
There is a variation worth knowing about: a developer who loses control of their store account to a phishing message aimed at developers, after which an update is pushed under their name. Either way, the practical lesson is the same. Trust in an extension is not permanent, and an audit beats a memory of having chosen carefully.
The extensions you never installed
Not every extension in your list arrived because you clicked Add. Three other routes exist, and all three are worth checking.
- Bundled with a desktop program. An installer on Windows can register an extension so it appears the next time you open the browser, usually with a prompt you can decline. On a Mac the equivalent arrives as an app that contains a Safari extension. These are the classic source of ad injection, described in fixing a browser that opens ads and redirects.
- Enterprise policy. A work laptop can have extensions installed centrally, which is legitimate. A personal machine showing an extension marked installed by your administrator, with the remove button grayed out, has picked up a policy it should not have, and the policy has to be removed before the extension will go.
- Loaded in developer mode. An unpacked folder loaded locally never went through any store review. If you did not put it there deliberately, treat it as hostile.
Store review is worth calibrating too. Chrome, Edge, Firefox and Safari all run automated checks and some human review, which stops the obvious cases. It does not stop an extension that behaves for months and changes later, since the review happens at submission, not continuously.
The five minute audit
Do this on every browser you use, including the one on your work machine if the rules allow it.
- Open the list:
chrome://extensions,edge://extensions,about:addonsin Firefox, or Safari settings then Extensions. On a Mac also check System Settings, then General, then Login Items and Extensions. - Say out loud what each one does for you and when you last noticed it working. Anything you cannot answer goes. Unused extensions carry the same access as used ones.
- Open Details on the ones you keep and read the permissions. An extension that changes the look of one site should not have access to all sites, and a theme or a clock should need almost nothing.
- Restrict site access. Chrome and Edge let you set each extension to run on click, or only on specific sites you list, instead of on every site. Firefox has similar per site controls under the extension permissions tab. This is the single most effective setting on this page, because it turns constant access into occasional access.
- Check the listing before you keep something you rarely think about: recent reviews complaining about new behavior, a developer name you do not recognize, and a last updated date that is either years stale or suspiciously fresh for a simple tool.
- Remove, do not just disable. A disabled extension still updates and can be re-enabled by anything running as you.
If you remove something that was misbehaving, finish the job: sign out of all devices on your important accounts, then change the passwords of anything sensitive you used in that browser. What your browser itself was holding is worth reviewing at the same time, using the checklist for passwords saved in a browser.
Judging an extension before you install it
| Signal | Lower risk | Higher risk |
|---|---|---|
| Permissions requested | One named site, or access only when you click its icon | All sites, plus cookies, downloads or browsing history |
| Who publishes it | A named organization or the maker of a service you already pay for | An anonymous developer account with one listing |
| How it makes money | Paid, part of a paid product, or a funded open source project | Free, heavy on features, no explanation anywhere |
| Source code | Public repository that matches the published version | None available |
| What it replaces | Something the browser genuinely cannot do | A feature already built into the browser |
| Recent reviews | Steady, specific, unremarkable | A wave of complaints about ads or redirects after an update |
The strongest filter is the last row of that table. Modern browsers already do tab grouping, password storage, translation, reading mode, price history in some cases and picture in picture. An extension that duplicates a built in feature is asking for total access to your browsing in exchange for something you already have.
Be skeptical of anything free that is expensive to run. Coupon finders, shopping helpers, download managers and free VPN add-ons all need money from somewhere, and the usual source is your browsing history sold onward. The mechanics of that market are covered in how web tracking works.
The setup worth doing today
Get to a number you can defend, usually between zero and five extensions. Set each survivor to on click or specific sites rather than all sites. Keep anything that touches money or work in a separate browser profile with no extensions at all, which takes a minute to create and removes the entire question from your banking. Then repeat the audit when something changes: a new one gets installed, an old one suddenly behaves differently, or ads appear where they should not.
If you already found something bad, assume it saw what you did in that browser. Sign out everywhere, change the important passwords from a different device, and if the machine also shows the wider symptoms described in the guide to malware families, work through the full cleanup sequence rather than stopping at the extension.
Common questions
Can a browser extension see my passwords?
Yes, if it has access to the site you are signing in to. An extension runs inside the page, so it can read what you type into a login form and read the page after you are signed in. It can also see passwords filled in by your browser on that page. This is why access should be limited to the sites where an extension is actually needed.
Are extensions from the Chrome Web Store or Firefox add-ons site safe?
Safer than anything installed from elsewhere, but not guaranteed. Store review happens when a version is submitted, so it catches obvious abuse rather than an extension that behaves well for a year and then changes hands. Treat the store as a filter that removes the worst listings, not as an ongoing audit of the ones you already installed.
How do I tell which extension is causing a problem?
Turn all of them off, confirm the problem goes away, then re-enable them one at a time until it returns. The last one you switched on is the cause. If the problem continues with every extension disabled, it is not an extension, so look at site notification permissions and at programs installed on the computer itself.
Does an ad blocker need to read all my pages?
Yes, and that is a genuine case where the permission is justified, because blocking content means inspecting every page. It is also why an ad blocker is worth choosing more carefully than any other extension. Prefer well established projects with public source code, and avoid clones with similar names, which are a common way to get a malicious one installed.
What should I do after removing a malicious extension?
Sign out of all devices on your important accounts, which invalidates any session token the extension could have copied, then change those passwords from a device that was never affected. Start with your email account, since it controls the resets for everything else. Then check your browser for changed search settings and unfamiliar notification permissions.