How to Vet a Browser Extension Before You Install It

Browser extensions occupy an unusual position. They run inside the browser, with access to the pages you load, which by definition includes your email, your bank and anything else you are signed into. Installing one is closer to installing an application than to changing a setting, but it takes one click and no ceremony, and it is presented more like a setting.

The first thing to read is the permission list, which the browser shows before installing and which almost nobody reads. The phrase worth pausing on is the ability to read and change all your data on all websites. Sometimes that is genuinely required: content blockers and password managers need broad access to do their job. Often it is not. A currency converter, a theme, or a tool that only operates on one site should not need to see every page you visit. When the request does not match the function, that mismatch is the signal.

Next, look at who publishes it and how long it has been around. A listing with a developer name you can trace to a real project or company is different from an anonymous one. Check the review dates rather than the star rating alone: a run of recent reviews complaining about ads, redirects or new behaviour often marks the point where an extension changed hands.

That change-of-hands problem is the one most people are unprepared for. An extension with a large install base is a valuable asset precisely because it already has permission to modify pages for a lot of people, and updates arrive automatically and silently. A tool that was trustworthy for years can be sold, and the new owner inherits the permissions and the installed base. This is not a theoretical risk; it is a recurring pattern, and it is why an extension you no longer actually use is worth removing rather than leaving dormant.

Prefer extensions that are open source and widely used, where the code can be inspected and many people would notice a change. Prefer ones that work on specific sites over ones that work everywhere. And prefer the browser's own store listing to a download offered by a website, because sideloaded extensions bypass the review process entirely, thin as that review sometimes is.

It is also worth auditing what you already have, since the list tends to accumulate. Open the extensions page, and for each entry ask whether you used it this month and whether you would install it again today knowing its permissions. Most people find two or three they forgot were there. Each removal is a small performance win as well, because every extension costs memory in every tab it injects into.

A reasonable steady state for most people is a content blocker, a password manager, and possibly one or two tools tied to specific work. Beyond that, the marginal extension usually costs more in access than it returns in convenience.