Why an extension means access to your data
A normal website is isolated: the browser keeps it in a sandbox and blocks it from other tabs' data. An extension is different. It is a program you install inside the browser, and on install it asks for permissions. The phrase "Read and change all your data on the websites you visit" (the <all_urls> permission in the manifest) means exactly this: the extension receives the contents of any page you open, along with whatever you type on it.
Through so-called content scripts, an extension injects into the page and works with form fields, text, and cookies on par with the site itself. Chrome's Manifest V3 standard limited the old intercepting webRequest API and shifted request filtering to declarative rules, but extensions still retain read access to open pages — and that is the main privacy risk. So a theme-changing extension that asks for access to all sites is already a red flag: the feature doesn't need that much power.
The second key point is updates. Extensions update automatically and silently. The code you install today can become different tomorrow without any action from you. That is what makes extensions a convenient entry point for anyone hunting for data.
How extensions steal data and money
A malicious extension acts quietly: the interface stays the same while the harmful logic hides in the background. The main techniques:
- Session cookie theft. The extension reads your session files and sends them to a remote server. With an active session, an attacker doesn't need your password — they log in as you, bypassing even two-factor checks.
- Capturing what you type. Logins, passwords, card numbers, and codes are read from form fields at the moment of entry, before the page encrypts and sends them.
- Rewriting page content. The extension edits the page: it substitutes its own crypto wallet address for the one you copied, changes details in a payment form, or inserts a phishing button.
- Ad injection and affiliate swaps. Third-party ads get injected into pages, and affiliate tags are appended to store links — you generate revenue for the extension owner without knowing it.
- Redirects and tracking. The extension logs every address you visit and sells that history, and sometimes redirects you to fake sign-in pages.
A separate danger is extensions that genuinely do their advertised job but also collect your browsing history "for analytics." Technically not a virus — in practice, constant surveillance of everything you open.
How a harmless extension turns malicious
An extension can stay clean for years and then abruptly change behavior. Typical scenarios:
- Change of owner. The author of a popular extension sells it, and the new owner adds data collection with the next update. An audience of thousands comes bundled with the purchase.
- Embedded third-party code. A developer adds an ad or analytics module to make money, and it starts pulling more than declared.
- Compromise of the developer's account. Through phishing, an attacker takes over the store account and publishes a malicious version under the author's name — users receive it as an ordinary update.
This is why an extension's presence in an official store is no guarantee of safety: malicious add-ons often pass moderation and live there for a long time, and a version can turn dangerous only after you install it. The same "store is not a guarantee" principle applies to mobile apps too — we covered it in our breakdown of malicious VPN apps.
Signs of a dangerous extension
Before installing, and when auditing what's already there, judge extensions by several signals. A mismatch between requested rights and function should raise concern: a simple tool like a unit converter or a dark theme has no reason to need access to all sites, the clipboard, or tab contents. Other details are suspicious too — the extension recently changed its name or developer, it has no clear privacy policy, its reviews look uniform and inflated, and its name and icon nearly copy a known popular add-on. That resemblance is a classic lure: the user installs the fake instead of the original.
Watch behavior after install as well: new tabs open on launch, the default search engine changes, pop-up ads appear where there were none. These are common traces of an extension tampering with pages. The logic of judging permissions overlaps with how sites track you through your browser fingerprint.
How to audit installed extensions
Run a review at least every couple of months and after each new install. The steps are roughly the same across Chromium-based browsers and Firefox:
- Chrome and Edge: open
chrome://extensions(in Edge,edge://extensions), enable developer mode, and review the list. For each extension, click "Details" and check the permissions and "Site access" section. - Firefox: open
about:addons, the "Extensions" tab, and check permissions in each add-on's properties. - Remove anything you didn't install deliberately or don't use. An unfamiliar extension is reason enough to delete it without a second thought.
- For needed but "greedy" add-ons, restrict access: instead of "on all sites," choose "on click" (activeTab) or a list of specific domains. Then the extension sees a page only when you launch it yourself.
Separately, check whether your start page and default search have been changed — such a swap often survives removing the culprit and must be fixed in browser settings by hand.
Does a VPN protect against malicious extensions?
Here it's important to be honest: a VPN by itself does not protect you from a malicious extension. A VPN encrypts traffic between your device and its server — that shields data from your provider and from an eavesdropper on a public network. But an extension works inside the browser, before traffic enters the tunnel: it sees the open page in its original form, so channel encryption is no obstacle to it. If you want to see where the tunnel does and doesn't help, our breakdown of a man-in-the-middle attack shows the network side clearly.
Protection against these threats is layered. Here's what actually helps against typical extension techniques:
| Threat | Does a VPN help? | What actually protects |
|---|---|---|
| Extension reads the open page | No | Audit and remove unneeded extensions, "on click" mode |
| Session cookie theft | No | Fewer extensions, signing out of accounts, clearing sessions |
| Password captured from a form | No | Password manager with domain-bound autofill, 2FA |
| Traffic interception on open Wi-Fi | Yes | A VPN — this is where it belongs |
| Provider tracking which sites you visit | Yes | A VPN encrypts DNS and traffic to the server |
So extensions and a VPN cover different areas. Extension hygiene protects what happens inside the browser; a VPN protects the channel outward — traffic on public networks and from your provider. If you want a VPN as a separate, auditable, no-logs layer, see LiMP VPN pricing. But a built-in "VPN" inside some random browser add-on is a bad idea: it is the same kind of extension with access to your pages — exactly the risk this whole article is about. Downloading a VPN itself carries its own pitfalls, which we covered in how to download a VPN safely.
What to do: a security checklist
- Open the extensions list in your browser and remove anything you don't use or don't remember installing.
- For the rest, check permissions: if the rights are broader than the function, restrict site access to "on click" mode or specific domains.
- Install extensions only from the official store and only from a known developer — and even there, read the permissions and recent reviews.
- Never install add-ons from direct links in emails, ads, or chats — that's a common delivery channel for fakes.
- Keep a separate "clean" browser profile with no extensions for banking and payments.
- Turn on two-factor authentication everywhere you can and store passwords in a manager — so one extension can't unlock all your accounts at once.
- After removing a suspicious extension, check your start page and default search, and change passwords to important services if needed.
