If you have ever added an ad blocker to your browser or let a tool check your spelling as you type, you have used a browser extension. They are one of the most useful features of a modern browser and also one of the most quietly risky. This guide explains what extensions are, what people use them for, how to install and remove them, and, just as importantly, the permission and privacy questions you should ask before trusting one with your browsing.
What a browser extension is
A browser extension, often called an add-on, is a small program that plugs into your web browser and gives it abilities it did not have out of the box. The browser handles the basics of loading and showing web pages; an extension bolts extra behaviour onto that, like hiding adverts, saving passwords or translating text.
They are not full standalone apps. An extension only works inside the browser it is installed in and usually does one focused job. Chrome, Firefox, Edge, Safari and most other browsers all support them, each through its own store, though an extension built for one browser does not automatically work in another.
What people use extensions for
The range is wide, but a handful of categories cover most real-world use. Ad and content blockers strip adverts and trackers from pages, which can make browsing faster and cleaner. Password managers store your logins and fill them in for you, so you are not reusing weak passwords across sites. Grammar and writing tools check your spelling and phrasing as you type into any text box.
Beyond those, shopping extensions hunt for discount codes or compare prices, note-takers and read-later tools save pages for later, and accessibility add-ons adjust how pages look for easier reading. The common thread is convenience: each one removes a small friction from something you already do in the browser.
It is worth noting that many of these jobs can also be done without an extension at all. Some browsers now build ad filtering, password storage and reading modes directly into the software, and a growing number of services offer their own apps instead. That matters because every extension you add is a separate piece of software to trust, so if your browser already does the job natively, reaching for an add-on is not always the better option.
Which browsers support extensions
Most major browsers support extensions, but not identically. Chrome has the largest catalogue by far, and because Edge and several other browsers are built on the same underlying engine, they can usually run Chrome’s extensions too. Firefox runs its own add-ons through its separate store. Safari supports extensions as well, though its selection is smaller and the ones that handle your data are reviewed more tightly by Apple.
The upshot is that an extension built for one browser will not automatically work in another, and the same tool may behave slightly differently across them. If you are deciding which browser to build your habits around, our comparison of Chrome versus Safari covers how the two differ on extensions and privacy. For now, the key point is to check that an extension officially supports your browser before relying on it.
How to install an extension
Installing is deliberately easy. Each browser has an official store, such as the Chrome Web Store or Firefox Add-ons, where you search for what you want, open its listing and click a button to add it. The browser then shows you what the extension is asking permission to do and asks you to confirm. After that it appears in your toolbar or extensions menu, ready to use.
The ease is a double-edged thing. Because adding an extension takes two clicks, it is tempting to install them without a second thought. That install-screen permission prompt is the one moment the browser asks you to pause, and it is worth actually reading rather than clicking straight through.
How to manage and remove extensions
Every browser gives you a central place to see what you have installed, usually reached through a puzzle-piece icon near the address bar or an Extensions item in the settings menu. From there you can turn an extension off temporarily, change its permissions, or remove it entirely. Removal is instant and reversible: if you change your mind, you reinstall it from the store.
A good habit is to review this list every few months and uninstall anything you no longer use. Each extension you keep is a small ongoing risk, so trimming the list to only what you actively rely on is one of the easiest security wins available to you.
The permissions problem
Here is the part that deserves real attention. To do their jobs, many extensions request permission to read and change the content of the pages you visit, often on every website. For some tools that is legitimate: an ad blocker genuinely has to see a page’s content to hide the ads on it.
The trouble is that a lot of extensions ask for far more access than their function needs. Reporting by Cybernews has highlighted how commonly extensions request broad, sensitive permissions. An extension that can read every page can, in principle, see what you type into forms, including passwords, and read the data on your screen. When you see a simple-looking tool asking to read all your data on all websites, that mismatch is a reason to stop and reconsider.
Privacy risks worth knowing
Even extensions that are not outright malicious can be a privacy drain. Some quietly collect your browsing history or activity and sell it to data brokers as their real business model, with the useful feature acting as the lure. Because this happens in the background, you would never notice from using the extension itself.
This is the same category of concern that applies to the data a browser handles generally, which is why it pays to understand related tools. Our guides to password managers and to cookies cover two areas extensions frequently touch, and knowing how those work makes it easier to spot when an add-on is overstepping.
When a trusted extension turns bad
One of the most unsettling facts about extensions is that a safe one can become dangerous after you install it. Two routes make this possible. An extension can be sold to a new owner who repurposes it, or the developer’s account can be hijacked. Either way, a malicious update can be pushed out and installed on your machine automatically, because extensions update silently by design.
This is not theoretical. In December 2024, security researchers at Darktrace and Sekoia documented a campaign in which attackers phished extension developers, took over their store accounts and pushed malicious updates to multiple popular extensions, affecting a large number of users before being caught. The payload tried to harvest login tokens and session cookies. The lesson is that an extension’s good reputation at install time is not a permanent guarantee.
How to vet an extension before you trust it
You cannot eliminate the risk, but you can shrink it with a few checks. Install only from your browser’s official store, never from a link in a pop-up or email. Look at the user count and reviews: a tool used by millions with a long track record is a safer bet than an obscure one with a handful of installs. Check who the developer is and whether they have a real website and privacy policy.
Then read the permissions on the install screen and ask whether they match the job. A calculator extension has no business reading all your browsing data. Prefer extensions that request the least access they can. Finally, revisit your installed list regularly and remove what you no longer need. None of this takes long, and together it is the difference between using extensions sensibly and handing strangers a window into everything you do online.
The honest bottom line
Browser extensions are genuinely useful and most people have good reason to use a few. But each one is a small program with potentially deep access to your browsing, run by someone you are choosing to trust. Treat installing one as a decision rather than a reflex: check the source, question the permissions, keep the list short and stay aware that even a good extension can change hands. Used that way, the convenience is worth it; used carelessly, extensions are one of the quietest ways personal data leaks out of an otherwise careful setup.
