Browser Extensions & Add-Ons: Risks

Browser extensions add features like coupons, ad blockers, PDF tools and password helpers. But many can read everything you do on every website, including passwords and bank accounts. A bad or hijacked extension is a quiet way to steal data.

• Everyone
• Office Workers
• Parents

Why they are risky

• Extensions often ask permission to "read and change all your data on all websites." That means they can see what you type and view.
• Criminals publish fake extensions that look like popular tools or buy and update existing extensions with malicious code.
• Some track browsing, inject ads, redirect searches or steal login cookies.
• Extensions are updated automatically, so a safe one can turn bad later.
• Too many extensions slow the browser and cause crashes.

Choose carefully

• Install only what you need, from the official store of your browser (Chrome Web Store, Edge Add-ons, Firefox Add-ons)
• Check the publisher, number of users, ratings and recent reviews. Beware of copycats with similar names
• Read the permissions requested. Does a calculator need access to all websites? If it does not make sense, do not install it
• Look at the privacy policy and how it handles data
• Do not install an extension because a pop-up, email or website told you to
• On work computers, follow the IT policy; do not install extensions on your own if it is not allowed

Manage what you have

• Review your extensions regularly (in the browser's extensions menu) and remove ones you do not use or recognize.
• Limit access: set extensions to "on click" or only on specific sites where the browser allows.
• Keep the browser and extensions updated.
• Use private or separate profiles without extensions for banking and sensitive accounts.
• Be careful with extensions that handle passwords or crypto wallets; use only well-known providers.

If you suspect a bad extension

1. Remove it and restart the browser.
2. Run a security scan. See Malware & Antivirus.
3. Change passwords for important accounts from a clean device and turn on two-step verification. See Two-Factor Authentication.
4. Check bank and card statements. Report fraud. See Reporting Cybercrime.
5. Tell your employer's IT team if it happened on a work device.

Last updated: October 8, 2026