That tab manager you installed three years ago? It deserves a look.
Quick test. Open your browsers extensions page now and count what is there. Most people find more than they expected and at least one they cannot remember installing.
What bothers me about extensions is that we hand them the keys without a thought. Your browser is where you do everything. Check email, pay bills, open the work dashboard. An extension sits in the middle of all that and it can look.
An extension can see more than you think.
When you click "Add," your browser shows a box. If it says "read and change all your data on all websites " that is the one and it means exactly what it says. An extension can read your pages, bank pages. Watch you type. An extension can keep a log of every site you visit. An extension can take the cookies that keep you logged in which's like handing over a spare key to your accounts.. An extension can slip ads into pages or push you toward a copycat login screen.
You will never know. To your computer it is just you browsing.
So how does a harmless extension turn nasty? A few. None of them need you to do anything dumb.
Sometimes an extension is bad from the start. Fake reviews, a name that looks like a tool and that is it.
Sometimes an extension gets sold. Picture a developer who made a free tab manager years ago and got tired of maintaining it. Someone offers money. The developer says yes. A weeks later an update sneaks in tracking code and since extensions update themselves everyone who has it gets the new version without clicking a thing. That is close to what happened with The Great Suspender, which was eventually pulled for code.
Sometimes the developer gets phished. Attackers get into their account. Upload a bad version. That happened to a handful of extensions at the end of 2024 one of them from a cybersecurity company. Think about that for a second.
Sometimes there is no trick at all. An extension simply sells what you browse. Says so in a privacy policy nobody reads. A 2019 investigation known as DataSpii found browsing data some of it from pages turning up with data brokers.
It is worse at work.
Take one persons browser. Multiply it by a whole company. Email, shared files, customer data, source code all a click away. If a bad extension grabs a login session there nobody on the network sees it happen. Most companies lock down their laptops well but have no idea what is installed inside the browsers. People just add stuff.
What I would watch for
Odd ads. A search engine you did not pick. A browser that has gotten slow. An update that suddenly wants permissions. A tool that changed owners.. Honestly any simple tool that wants every site on your list.
What I would do
Clear out the junk first. If you have not used the extension this month remove the extension. Then before you install anything read what it asks for. A weather widget has no business reading your bank tab. Look at who made it how long it has been around. When it was last updated. Do not lean on star ratings they are easy to fake.
Set the extensions you keep to run "on click " or limit them to sites (the option is in the extensions menu). Doing your banking? Use a browser profile with no extensions installed.
If you manage a team write an approved list. Block everything else. That way when something does go wrong you can pull it fast. Change the passwords it might have touched.
Before you click Add