Browser Extensions in 2026: Why a Trusted Add-On Can Turn Malicious Overnight, What Permissions Like Read and Change All Your Data Actually Allow, and How to Audit and Allowlist Extensions Across a Business
- Equipo de Internet Pros
- October 22, 2026
- Redes y Seguridad
Este artículo está disponible solo en inglés.
Somebody on your team installed a handy coupon finder, a PDF converter or a tab manager two years ago. It has a good rating and a few hundred thousand users. Last night it updated itself in the background, and the new version copies every page they open, including the company CRM, the bank portal and the Microsoft 365 admin center. Nobody clicked anything. That is the problem with browser extensions in 2026: you trust one once, and the browser keeps trusting every update after that.
Why Extensions Are Such an Attractive Target
An extension runs inside the browser, which is where most work now happens. Depending on its permissions, it can see the pages you open, read what you type into forms, and act with your signed-in session. Firewalls, email filters and multi-factor authentication do not stand between an extension and your data, because the extension is already past all of them.
Extensions also update themselves silently. The Chrome Web Store, Microsoft Edge Add-ons and Firefox Add-ons all review new versions, but review is mostly automated and attackers have become good at hiding code that only switches on later or downloads its instructions from a server after install. A user approves the permissions once, at install time. Later updates that stay within those permissions do not ask again.
When you install an extension, you are not trusting the code you see today. You are trusting whoever controls the developer account for as long as the extension stays installed.
How a Good Extension Goes Bad
Very few dangerous extensions start out malicious. Most become dangerous in one of three ways:
- The extension is sold. Solo developers with popular free extensions receive steady offers to buy them. The buyer gets an installed base of trusting users and pushes an update that injects ads, tracks browsing or steals data. The Great Suspender, a tab manager with millions of users, was removed from the Chrome Web Store in 2021 after exactly this pattern.
- The developer account is hijacked. In December 2024, attackers sent developers a fake Chrome Web Store policy email, tricked them into approving a malicious app with access to their account, and pushed poisoned updates. The best-known victim was the data-security company Cyberhaven, whose extension was modified on Christmas Eve to steal session cookies and tokens, aimed largely at Facebook business and ad accounts. Researchers linked the same campaign to dozens of other extensions with a combined user base in the millions.
- The extension plays a long game. Throughout 2025, researchers kept finding families of extensions that behaved normally for months or years, built up reviews and in some cases earned featured or verified badges, then switched on tracking or redirect code through an update.
There is also the simpler case: copycat extensions that imitate a real brand, such as a fake AI assistant or a fake wallet, and are harmful from the first install.
What the Permission Warnings Actually Mean
Browsers translate technical permissions into short warnings when you install an extension. They are easy to click past, and they are more serious than they sound.
| Warning you see | What the extension can do | Risk |
|---|---|---|
| Read and change all your data on all websites | Read every page, including form fields, inject scripts, and change what you see, on every site you visit | Highest. Enough to steal data from any web app you use |
| Read and change your data on a list of sites | The same powers, limited to the named domains | Depends on the sites. Fine for a grammar tool on docs, risky if it lists your bank |
| Read your browsing history | See every URL you visit and when, often through the tabs permission | High for privacy; URLs often contain document names and IDs |
| Manage your downloads | Start, open and reroute downloads | Can deliver malware or swap files |
| Communicate with cooperating native applications | Talk to a program installed on the computer | Used by password managers, but also a bridge out of the browser sandbox |
The phrase to remember is all websites. An ad blocker or password manager genuinely needs that access. A color picker, a currency converter or a screenshot tool usually does not, and asking for it is a red flag.
What Manifest V3 Did and Did Not Fix
Chrome finished moving extensions to Manifest V3 over 2024 and 2025, and Edge followed. The new rules ban extensions from downloading and running code that is not shipped in the package, which makes some tricks harder and gives store reviewers a better view of what an extension does. Content blockers also lost some flexibility, which caused most of the public complaints.
What Manifest V3 did not change is the permission model. An extension with access to all websites can still read every page and still be updated by whoever holds the developer account. The Cyberhaven attack used Manifest V3 extensions. Treat it as a modest improvement, not a solution.
Signs an Extension Has Turned
- New ads, pop-ups or sponsored results appearing on sites that never had them.
- Searches redirecting through an unfamiliar domain, or the default search engine changing on its own.
- A sudden request for new permissions after an update. Chrome disables the extension until you approve, which is your chance to say no.
- Recent reviews in the store complaining about the same behavior, or the listing quietly showing a new developer name or website.
- The extension disappearing from the store. Chrome flags removed extensions as malware in many cases, but not every removal reaches installed copies quickly.
An extension control checklist for small businesses
- Take an inventory. Chrome Enterprise Core (free) and Microsoft Intune or Edge management can report every extension installed on managed browsers. You will usually find far more than expected.
- Switch to an allowlist. Set
ExtensionInstallBlocklistto*and list approved extension IDs inExtensionInstallAllowlist. Firefox supports the same idea through theExtensionSettingspolicy. - Block dangerous permissions with the
ExtensionSettingspolicy, and useruntime_blocked_hoststo keep every extension off your bank, payroll and admin portals. - Prefer vendors over hobby projects for anything that needs access to all websites, and check who publishes it, not just the rating.
- Separate profiles. Use a clean browser profile with no extensions for banking and admin work.
- Review quarterly. Remove extensions nobody uses, and recheck the publisher of the ones that stay.
- Plan the response. If an approved extension is compromised, block it by ID, then sign everyone out and rotate sessions for the apps it could see, because stolen cookies keep working after the extension is gone.
Personal Devices and Home Users
Policies only reach managed browsers. If staff sign in to company apps from personal laptops, their personal extensions come along. Conditional access rules in Microsoft Entra ID or Google Workspace can require a managed device or a managed browser for sensitive apps. For home users, the same habits apply on a smaller scale: keep the list short, remove anything you do not use every week, and read the permission warning before clicking Add.
En resumen
Browser extensions are small programs with a direct view of your most valuable data, and they update without asking. Most are fine, but the ones that go bad do so quietly and at scale. An inventory, an allowlist and a short list of blocked permissions turn the browser from an open door into something you actually control, and they take an afternoon to set up.
Do you know what is running in your team’s browsers?
Internet Pros inventories browser extensions across your devices, builds an allowlist that keeps the tools people need, and deploys Chrome, Edge and Firefox policies through Intune or Google admin. Contact our team for a browser security check.
