Most people treat browser extensions like apps from a curated store - something reviewed, vetted, and roughly safe. They aren’t. Chrome’s extension ecosystem in particular operates with a degree of trust that would be alarming if it were applied to any other software category.
Extensions routinely request permissions to “read and change all your data on the websites you visit.” That phrasing, buried in the install prompt, means the extension can see everything you type, every page you load, and in many cases inject its own content into those pages. Users click through this in the same half-second they’d approve a cookie banner. The threat model and the UX are wildly mismatched.
The Acquisition Problem Nobody Talks About
The harder issue isn’t the permissions themselves - it’s what happens after an extension is installed and trusted. Legitimate, well-reviewed extensions get acquired. A developer sells their 200,000-user extension to a third party, the codebase updates silently in the background, and suddenly all those users are running software from a completely different entity with different incentives. This has happened repeatedly. The extension keeps its five-star rating, keeps its install count, and the new owners have inherited access to a significant slice of browsers with zero friction.
Chrome and Firefox both allow extensions to update automatically without re-prompting users for permissions. That’s the gap. You approved version 1.2 from the original developer. You’re now running version 4.1 from someone else.
Google Has Moved, Slowly
Manifest V3 - Google’s overhaul of the Chrome extension platform - was positioned partly as a security improvement, limiting how extensions could intercept network requests. It went fully into effect in 2024, removing Manifest V2 support from Chrome’s stable channel. The change was real and did reduce some attack surface, though it also broke a chunk of privacy-focused tools in the process, which is a different argument worth having separately.
The acquisition vector, though, remains largely untouched. There’s no policy requiring disclosure when an extension changes hands. There’s no ownership transparency layer visible to users.
The Inconvenient Audit
A reasonable response is to audit what you actually have installed. Go to chrome://extensions or Firefox’s Add-ons Manager right now and look at the list. Anything you don’t recognise, anything you installed once for a single task years ago and forgot - those are the ones worth removing. Not because they’re all malicious, but because inactive, unmaintained extensions are exactly what acquirers look for.
The extensions you trust most are the ones you should scrutinise hardest. They have the most access.