Most people treat browser extensions like free tools with no real cost. They’re not. When you install an extension - a grammar checker, a coupon finder, a tab manager - you’re typically granting it permission to read and change data on every website you visit. That’s not a worst-case scenario. That’s the default.
The Chrome Web Store and Firefox Add-Ons both show permission disclosures during installation, but the UX design buries them. You click through a single screen, the extension loads, and you never think about it again. Meanwhile, that extension now has a live view of your banking sessions, your email, your medical records portal - anything your browser touches.
The Extension Economy Is the Problem
Extensions are rarely built by teams with serious security resources. Many are side projects, acquired mid-life by companies you’ve never heard of, or maintained by a single developer who stopped updating them in 2023. There’s a documented pattern - covered in reporting by Ars Technica and others - of popular extensions being purchased specifically to monetise the user base through ad injection or data harvesting. The users find out when the extension suddenly starts behaving differently, if they notice at all.
Google introduced Manifest V3 partly to limit the scope of what extensions can do, and that change has been rolling out across Chrome. But V3 still doesn’t fundamentally solve the permission model problem. An extension with broad host access still gets broad host access - the architecture just changed slightly, not the trust relationship.
What Actually Keeps You Safe Here
Almost nothing, currently.
The best practical advice - use a separate browser profile for sensitive tasks, audit your extensions twice a year, remove anything you don’t actively use - is advice almost nobody follows. It’s not realistic to expect that behaviour at scale, and browser vendors know it.
What would actually help is a tiered permission model that requires extensions to request specific site access rather than blanket access, and that treats permission changes after installation as a new consent event. Safari’s per-site extension permissions are a step in this direction. Chrome’s model still lags.
The Invisible Attack Surface
The reason this doesn’t get the same attention as app store security is that extensions feel small and peripheral. They’re not. For most users who work in a browser all day, the extension layer sits between them and nearly everything they do online. That’s not a peripheral risk - it’s central, and it’s one most people haven’t consciously taken on.