Think about the last extension you installed. Maybe it was an ad blocker, a coupon finder, a grammar checker. You clicked ‘Add to Chrome’ and moved on. Did you check who made it? Did you read the permissions it asked for?
Probably not. Almost nobody does.
Here’s the thing — researchers at the University of Wisconsin found that some popular websites are vulnerable to browser extensions that can extract passwords, credit card numbers, and even Social Security numbers directly from the page’s HTML code. That’s not a theoretical risk. That’s researchers actually demonstrating it works.
And it gets broader than that. A 2025 study on malicious browser extensions found that bad extensions can harvest names, addresses, phone numbers, email addresses, login credentials, and financial information like credit card and bank account details. All of it. From the pages you visit every day.
Mozilla’s official support documentation is clear about it: if an extension has permission to read everything on a page, that includes anything you type into that page. Your password before it gets hidden behind dots. Your card number before the site masks it. All of it is readable as plain text for a moment — and an extension with the right permissions is watching.
Georgia Tech researchers tested more than 100,000 extensions in the Chrome Web Store and found thousands that compromise user data. That’s how many extensions are sitting there, available to install — with wildly varying levels of trustworthiness.
So what do you actually do with this?
First, go look at what extensions you already have installed. In Chrome, it’s the puzzle piece icon in the top right — click it, then click ‘Manage Extensions.’ In Firefox, it’s the menu button, then Add-ons and Themes. You might be surprised what’s in there.
For each one, ask yourself: do I actually use this? Do I know who made it? Does it have a real company behind it with reviews and a track record? If the answer is ‘I have no idea,’ consider removing it. The fewer extensions you have, the smaller your risk.
When you do install something new, click into the permission details before you accept. If a simple color-picker extension is asking to read data on all websites you visit, that’s a red flag. The permissions should match what the extension actually needs to do its job.