Most of us treat browser extensions like small, harmless helpers: a dark mode toggle, a coupon finder, a grammar checker tucked into every text box. But an extension is software running inside the application where you bank, email and work. Researchers have spent the past couple of years showing how much trust we hand over without thinking, and the problem is growing rather than shrinking.
What Extensions Are Allowed to Ask For
When you add an extension, the browser shows a short list of permissions that most people click through in a second. It deserves more attention. Chrome's documentation lists warnings such as "Read and change all your data on all websites," along with access to your browsing history, clipboard data, and even your other extensions. The first of those means the extension can see whatever a page displays, from messages to account details.
Developers often ask for more than they need because it is easier. Google's own guidance urges explicit, minimal and optional permissions, which says plenty about how often the opposite happens. And almost nobody goes without: a 2026 report covered by The Hacker News found that 99% of enterprise users run at least one extension.
How a Trusted Add-on Turns Bad
The most common route is a sale. The Great Suspender, which had more than two million installs, was sold by its original developer in June 2020 to an unidentified buyer. Later versions were flagged as malware, and Google removed it in February 2021.
The other route is a hijacked developer account. In December 2024, a phishing email posing as Chrome Web Store support tricked a Cyberhaven employee into authorizing a malicious app, which let attackers publish a poisoned update. It reached roughly 400,000 users through automatic updates and was caught about a day later. It went after Facebook-related data and cookies.
Chrome does disable an auto-updated extension until you approve new permissions. That helps, but only when the permissions actually change. A malicious update that works within the access you already granted arrives without a word.
What the Past Year Has Shown
The pattern has continued. Koi Security researchers uncovered three malicious extension campaigns across Chrome, Edge and Firefox, one of which used 18 extensions to reach 2.2 million users and collect meeting links, IDs and passwords. In January 2026, Socket researchers found five coordinated Chrome extensions aimed at corporate HR and ERP systems. They stole session cookies and even blocked security administration pages to avoid detection.
AI extensions are the newest worry. LayerX's 2026 report found they are 60% more likely to carry a known vulnerability and three times more likely to access cookies. It also found that 70% of enterprise users have an extension whose permissions grew over the previous year.
What Is Being Done About It
Most new defenses are aimed at companies rather than individuals. Push Security launched detection and automatic blocking of malicious extensions in March 2026, and the sector is consolidating, with CrowdStrike buying Seraphic, Zscaler buying SquareX, and Akamai announcing plans to acquire LayerX.
A caution on the numbers: many of these statistics come from vendors who sell protection, so treat them as signals rather than exact measurements. As far as I could find, no major browser yet warns you when an extension changes owners, so that check is still yours to make.
How to Review What You Have Installed
Every few months, open chrome://extensions or about:addons and go through the list. Remove anything you no longer use. Click Details on the rest and check which sites each can read; many can be limited to "on click" or specific sites.
Then look at the developer. A changed name, a rewritten listing or a new privacy policy after an update is a red flag. Read every permission prompt that appears after an update instead of dismissing it, and favor extensions from known companies or open-source projects with visible code.