Browser extensions can save hours of work — or quietly steal data. A short guide to what's safe.

What extensions can do

When you install an extension, it requests permissions. Common ones:

  • Read and change all your data on websites you visit — very broad; trust the publisher
  • Read your browsing history — broad
  • Display notifications
  • Storage — local data only, usually fine

A password manager needs "read all sites" to work. A coupon finder you've never heard of asking for "read all sites" should make you suspicious.

The publishers to trust

Generally safe extensions from known publishers:

  • Password managers: 1Password, Bitwarden, Dashlane, Keeper, LastPass (with caveats post-2022 breach)
  • MFA: Authy desktop, Duo Desktop
  • Productivity: Grammarly, OneNote Web Clipper, Save to Pocket
  • Privacy: uBlock Origin, Privacy Badger, HTTPS Everywhere (now mostly redundant)
  • Developer: React DevTools, Vue DevTools, JSON Viewer

The categories to avoid

  • "PDF converter" or "PDF to Word" extensions from unknown publishers — most are spyware
  • Coupon and shopping helpers — often steal browsing data
  • VPN extensions from companies you've never heard of
  • Shortened URL "previewers" — many phish
  • Cryptocurrency wallets unless you specifically use crypto (high-value target for scams)
  • Anything labelled "Premium" / "Pro" that demands payment after install

How to audit your extensions

  • Chrome: chrome://extensions/
  • Edge: edge://extensions/
  • Firefox: about:addons

For each, ask:

  • Do you still use it?
  • Do you remember installing it?
  • Is the publisher reputable?
  • What permissions does it have? Click Details.

Remove anything that doesn't pass this check.

"Inspect element" — when extensions are blocking

If a webpage loads but a button doesn't work, or a form refuses to submit, an extension may be interfering. Test in incognito (which disables extensions by default) — if it works there, you've found the culprit.

Enterprise policies

Your IT may force-install specific extensions (e.g. password manager) and/or block others. If you see:

  • "Installed by your administrator" — IT pushed it; you can't remove
  • "Blocked by your administrator" — IT vetoed it; ask why if it's something you need

This is normal and protects everyone.

"Unknown extension installed itself"

Modern browsers don't let extensions install without user consent — but some "free download" sites bundle them with installers:

  • Audit extensions
  • Remove anything you didn't deliberately install
  • Reset browser if there's a long list of garbage
  • Run antivirus — bundled installers often carry adware

Updating extensions

Browsers auto-update extensions. Sometimes an update changes permissions:

  • A popup notifies you "extension X now requires additional permissions"
  • Review carefully — a calculator extension suddenly wanting "all your data" is suspicious

When to ticket

Raise a ticket if:

  • A specific extension you need for work is blocked
  • You've removed extensions and the browser still acts compromised
  • You suspect malware came from an extension

Include the extension name, what you noticed, and what cleanup you've already done.