Browser extensions are among the most convenient tools you install—and among the few programs that can read everything you type on any website without raising an alarm. The uncomfortable truth is that an extension that was safe on the day you installed it can stop being safe after a single automatic update. Two 2026 investigations show exactly how that happens, and why a one-time vetting is no longer enough.
- Silent ownership changes: A popular extension can be sold to a new owner who pushes a malicious update to every existing user without any action on their part.
- Permissions are the real risk: Access to “all sites” lets an extension read page content, including credentials you type, so trust must be earned and rechecked.
- Cleanup is quick but incomplete: Removing an extension takes seconds, yet if it was active for a while you should also rotate passwords and revoke open sessions.
How a trusted add-on becomes a weapon
In October 2025, an extension called QuickLens, which integrated Google Lens into the browser, appeared in the Chrome Web Store. Two days later it was already being sold on an extension marketplace. According to research by Annex Security, the extension changed ownership on February 1, 2026, and version 5.8 arrived on February 17. It kept its original function but stripped security headers from every site visited and queried an external server every five minutes to receive code it executed on all pages. Roughly 7,000 users received the update without doing anything.
The second path is more direct: extensions built from the start to spy, disguised as something useful. In March 2026, Microsoft Defender researchers described extensions posing as AI assistants that, according to the reports they cite, reached around 900,000 installations. They collected full URLs visited and the contents of conversations with chatbots such as ChatGPT or DeepSeek. They were distributed through the Chrome Web Store, and because Edge accepts extensions from that store, a single listing reached both browsers. One detail captures the method: even when a user disabled data collection, later updates switched it back on.
The lesson from both cases is that the problem cannot be solved by choosing well once. Reviewing permissions has to be a recurring habit, just like checking the permissions of the apps on your phone.
Step 1: See what each extension can access
The permission that matters most is the ability to read and modify the websites you visit. Mozilla explains in its guidance on permission prompts that an extension with access to your data on all websites could read the content of any page you visit, including the data you type, such as usernames and passwords. Password managers, ad blockers, and shopping tools legitimately request this, but it means you trust that extension as much as you trust your bank.
How to check it by browser:
- Chrome. In More > Extensions > Manage extensions, open Details for each one. Site access can be limited to On click (only works when you press its icon), On specific sites, or On all sites. For almost everything you use occasionally, the first option is enough.
- Edge. Microsoft urges users to carefully review the permissions shown in the prompt before pressing Add extension, including when installing from the Chrome store.
- Safari (Mac). Apple advises clicking the extension button in the toolbar to choose how much access it has, and checking which extensions you have installed and what they do.
- Firefox. Access to local files is an optional permission that can be changed from each extension’s settings page, according to Mozilla.
Step 2: Warning signs that something has changed
There is no infallible indicator, but some signals should not be ignored:
- An update that requests new permissions. In the QuickLens case, the malicious version added permissions to modify traffic, which triggers a browser prompt to accept them. Annex notes that accepting without thinking is fairly common. If an extension you already had suddenly asks for more access, stop.
- A change in the developer name on the store listing. In QuickLens, the visible owner became an entity with no verifiable presence.
- Chrome’s Safety Check warning. The Safety Check, under Settings > Privacy and security, can alert you to potentially harmful extensions. With enhanced Safe Browsing protection enabled, Chrome also warns when you install an extension from a developer it does not consider trustworthy.
- Extensions you do not remember installing. Google warns that some Windows or Mac applications install Chrome extensions when they themselves are installed. If one appears that you do not recognize, remove it.
One caveat: the “featured” badge is not a lifetime certificate. QuickLens at one point carried Google’s featured badge, according to Annex, and the ownership change happened anyway.
Step 3: Clean up the browser
Removing an extension takes seconds in any browser:
- Chrome: right-click its icon and choose Remove from Chrome, or go to Manage extensions > Remove.
- Edge: in Extensions, use the More actions button next to the extension and select Remove from Microsoft Edge. If you found it in the Edge add-ons store and believe it is malicious, Microsoft lets you report it with Report abuse.
- Safari: go to Safari > Settings > Extensions, select the extension, and click Uninstall. Apple notes you can also delete the application that contains the extension.
- Firefox: disable or remove it from the add-ons manager.
A simple rule works well: if you have not used it in a month, it goes. Every installed extension is a door that someone can buy.
If you suspect a malicious extension has been active, removing it is not enough. Change the passwords for services you were logged into during that time and remotely sign out of open sessions on your Google, Meta, or Amazon accounts, because an extension with access to all websites may have seen far more than your history. And if a damaged extension breaks again after you repair it, Google notes that some program on your computer may be modifying it, which means running an antimalware scan. Before blaming the browser for slowness, it is also worth checking Windows Task Manager and Mac Activity Monitor.
Extensions live in a paradox: they are what makes the browser useful and, at the same time, one of the few programs that can read everything you type on any website without you noticing. Stores do review submissions, but the 2026 cases show they review the product, not who it is sold to afterward. Until browsers clearly disclose ownership changes with the same prominence as a new permission request, the most effective defense remains in your hands: few extensions, access only on click, and a review every few months.