Skip to main content

Browser Extension Security

Browser extensions can read everything you do online — passwords, banking, emails, private messages. Most people have extensions they don't need from developers they don't trust. Time for an audit.

Sarah Chen — Lead Security Editor
Sarah Chen·Lead Security Editor
Updated

Extensions We Trust

uBlock Origin

High Trust

Ad/tracker blocking

Open-source, widely audited, by a trusted solo developer (Raymond Hill). The gold standard.

Bitwarden

High Trust

Password auto-fill

Open-source, audited, from a reputable company. Only accesses password fields.

HTTPS Everywhere

High Trust

Force HTTPS

By EFF. Now redundant in most browsers but not harmful.

Privacy Badger

High Trust

Tracker blocking

By EFF. Open-source, learns tracking patterns automatically.

NordVPN / ExpressVPN extension

High Trust

VPN proxy + WebRTC leak prevention

From reputable VPN providers. Also blocks WebRTC leaks.

Extensions to Be Cautious About

Free VPN extensions

High Risk

Most free VPN extensions log and sell your browsing data. They have full access to all your web traffic.

Screenshot/screen recording

High Risk

Can capture sensitive content including passwords, banking info, and private messages.

Coupon finders (Honey, etc.)

Medium Risk

Track all your shopping behavior. Inject affiliate codes. May modify web pages.

Grammar checkers

Medium Risk

Read everything you type — emails, passwords, private messages. Only use trusted ones (Grammarly is established but reads all content).

Theme/customization extensions

Medium Risk

Often request unnecessary permissions. Many have been caught injecting ads or tracking.

Unknown productivity tools

High Risk

Small developer, unclear privacy policy, broad permissions. High risk of data collection or malware.

Extension Audit Checklist (5 Minutes)

  1. 1. Open your extension manager (chrome://extensions or about:addons)
  2. 2. For each extension, ask: "Have I used this in the last month?" — Remove if no
  3. 3. Check permissions — does it need "Read and change all data"? Only essential extensions should have this
  4. 4. Check developer — is it a known company or individual? Unknown = higher risk
  5. 5. Check last update date — extensions not updated in 1+ year may be abandoned
  6. 6. Target: 3-5 extensions maximum (password manager, ad blocker, VPN)

Frequently Asked Questions

Related Guides