Safety
Are Chrome extensions safe?
Safety
Are Chrome extensions safe?
On this page
- The short answer
- How Chrome vets extensions before you install them
- The permissions that actually matter
- Red flags to check before installing
- A reputable developer still isn't the same as 'safe forever'
- Keeping your browser safe after you install extensions
- What about extensions on mobile Chrome?
- Frequently asked
The short answer
Most Chrome extensions are safe, but not all of them. Chrome's Web Store review and Manifest V3 rules block a lot of abuse, but some extensions still request more access than they need or change ownership and add tracking later. Check permissions, the developer's reputation, install counts, and last-update date before adding any extension, and remove ones you no longer use.
How Chrome vets extensions before you install them
Every extension submitted to the Chrome Web Store goes through automated and, for higher-risk permissions, manual review before it's published. Manifest V3, the current extension platform, restricts remotely hosted code and requires extensions to declare upfront what data and browser features they touch, rather than requesting broad access at runtime the way older Manifest V2 extensions could.
That review catches a lot, but it isn't a guarantee. Reviews happen at submission and at major updates, not continuously, and an extension can be sold to a new owner or quietly change behavior in a minor update that doesn't trigger the same scrutiny. Chrome removes extensions after the fact when abuse is reported, which means some risk is caught only after people have already installed them.
Manifest V3, in short
Manifest V3 is Chrome's current extension platform. It limits remote code execution and requires clearer permission declarations, which is why some older, unmaintained extensions have been pulled or blocked from updating.
The permissions that actually matter
An extension's permissions tell you what it can see and do, and they're the single most useful signal before installing anything. Check them on the Chrome Web Store listing or under chrome://extensions before you add an extension.
| Permission | What it lets the extension do | When it's reasonable |
|---|---|---|
| Read and change all your data on all websites | See and modify content on every page you visit | Ad blockers, password managers, grammar checkers — tools that need to work everywhere |
| Read your browsing history | See the list of sites you've visited | History or bookmark managers only |
| Manage your downloads | See and control files you download | Download managers and file-conversion tools |
| Display notifications | Show pop-up alerts | Low risk on its own, but worth noticing if paired with broad site access |
| Access your clipboard | Read or write copied text | Clipboard managers and some productivity tools; unusual for a simple utility |
The rule of thumb: a permission should match the extension's stated job. A color picker or font finder needs to read the page you're on; it has no reason to also read your browsing history or manage downloads. If a simple tool asks for broad, unrelated access, that's the clearest warning sign there is.
Red flags to check before installing
Beyond permissions, a few quick checks catch most problem extensions before you add them.
- Vague or copy-pasted description: generic marketing text with no specifics about how the extension works
- No recent updates: an extension untouched for years may not support current Chrome security features, and unmaintained extensions are also the ones most often sold to new owners
- Review pattern looks off: a burst of five-star reviews posted in a short window, or reviews that read like templates
- Low install count for a common task: for well-known use cases like ad blocking or screenshots, an obscure extension with few installs deserves more scrutiny than a well-known one
- Requests unrelated permissions: see the permissions table above
- Developer contact is missing or generic: no privacy policy, no support email, no identifiable publisher
- Open the extension's Chrome Web Store listing and read its permission list before installing
- Match each permission to the extension's stated job — a narrow tool needs narrow access
- Check the developer's identity, privacy policy, and how recently the extension was updated
- Scan reviews for a sudden burst of near-identical five-star ratings
- After installing, revisit chrome://extensions periodically to confirm permissions haven't changed
A reputable developer still isn't the same as 'safe forever'
Well-known extensions from established companies, such as Bitwarden or 1Password for password management, or Dark Reader for display, carry lower risk because they have public track records, security audits, and a business reputation to protect. That's a reasonable starting filter, but it isn't a permanent guarantee: ownership changes happen, and even legitimate extensions occasionally ship bugs that need a fix. Treat 'reputable today' as a strong starting signal, not a lifetime pass.
The extensions most associated with real incidents tend to be small utilities that changed hands quietly, added ad-injection or data-collection code in a later update, and kept collecting installs because most users never revisit permissions after the first install.
Extensions with a track record worth checking against
-
BitwardenFreemium
Security & Privacy
Open-source password manager whose code is publicly auditable, which makes its permission use easier to verify; the free tier has fewer features than paid plans.
-
1PasswordPaid
Security & Privacy
Paid password manager built for families and teams with a transparent subscription model; there's no free tier, so it's a recurring cost.
-
Privacy BadgerFree
Security & Privacy
Learns to block invisible trackers automatically instead of relying on manual filter lists; it can occasionally block a script a site actually needs.
-
Security & Privacy
Lightweight Manifest V3 content blocker built to request fewer permissions by design; the lite rebuild drops some filtering options full uBlock Origin has.
-
Dark ReaderFree
Customization
Applies dark mode across sites with a narrow, single-purpose job that matches its permission needs; it can misrender colors on pages with unusual CSS.
-
GrammarlyFreemium
Writing
Checks grammar and tone on the pages you write on, which is why it needs broad page access; the free tier includes fewer suggestion types than paid plans.
Keeping your browser safe after you install extensions
Safety doesn't stop at install time. A short recurring check keeps your extension list from becoming a liability.
- Open chrome://extensions periodically and remove anything you no longer use, following our guide to removing an extension
- Re-check permissions after a major update, since they can change
- Keep Chrome itself updated, since browser-level security patches apply on top of extension review
- Avoid installing extensions from links in ads or unsolicited emails; go to the Chrome Web Store directly or from our extension directory
- Use a dedicated ad blocker or password manager instead of piling on multiple overlapping tools that all request page access
What about extensions on mobile Chrome?
Chrome on Android and iOS does not support desktop-style extensions the way Chrome for Windows, Mac, and Linux does. If you're looking for extension support on a phone, see our guide to Chrome extensions on Android and iPhone for the actual options and their tradeoffs, since claims of full extension support on mobile Chrome should be treated with caution.
Extensions mentioned in this guide
- BitwardenOpen-source password manager.
- 1PasswordPassword manager for families and teams.
- Privacy BadgerLearns to spot and block invisible trackers automatically as you browse
- uBlock Origin LiteLightweight Manifest V3 content blocker.
- Dark ReaderDark mode for every website.
- GrammarlyGrammar and tone suggestions as you type.
Frequently asked
Are Chrome extensions safe to use in general?
Most are, because Chrome reviews submissions and Manifest V3 limits what extensions can do without disclosure. But review happens mainly at submission and major updates, so checking permissions, developer reputation, and update history yourself is still worth doing before installing anything.
How do I check what permissions a Chrome extension has?
On the Chrome Web Store listing, scroll to the permissions section before installing. After installing, go to chrome://extensions, click 'Details' on the extension, and review its permissions there; you can also revoke site access for specific sites from that page.
What's the riskiest permission a Chrome extension can request?
'Read and change all your data on all websites' is the broadest permission, since it lets an extension see and modify anything on any page you visit. It's reasonable for tools that need to work everywhere, like ad blockers or password managers, but is a red flag on a narrow single-purpose tool.
Can a Chrome extension steal my passwords?
An extension with broad page access could technically capture what you type on a page, which is why permission scope matters. Reputable password managers are built specifically to protect credentials and are commonly audited; an unrelated extension requesting the same level of access has no legitimate reason to need it.
Does Manifest V3 make Chrome extensions safer?
Yes, compared to the older Manifest V2 platform. Manifest V3 restricts remotely hosted code and requires clearer upfront permission declarations, which closes off some of the ways extensions previously evaded review after publication.
Why do some Chrome extensions get pulled from the store after being popular?
Extensions sometimes change ownership, and a new owner can add tracking, ad injection, or other unwanted behavior in a later update. Chrome removes extensions after abuse is reported, which is why an extension can be popular for years and still get pulled later.
Is it safe to install a Chrome extension with very few reviews?
Not necessarily unsafe, but it carries more uncertainty than a well-reviewed, widely installed alternative. For common tasks like ad blocking, password management, or screenshots, an established option with a long track record is the lower-risk choice.
Should I trust an extension just because it has thousands of five-star reviews?
Mostly, but check the pattern. A steady accumulation of reviews over years is a good sign; a sudden burst of near-identical five-star reviews in a short window is a sign the reviews may not be genuine.
How often should I review the extensions installed in my browser?
Periodically, such as every few months, open chrome://extensions and remove anything you no longer use. Fewer installed extensions means less combined permission exposure and fewer things that need to be checked after Chrome or extension updates.
Can Chrome extensions work on mobile phones?
Chrome for Android and iOS doesn't support desktop-style extensions the same way desktop Chrome does. See our guide to Chrome extensions on Android and iPhone for the actual mobile options rather than assuming full extension support.
Are extensions from the Chrome Web Store always reviewed before publishing?
Yes, submissions go through automated checks and, for higher-risk permissions, manual review. That review isn't continuous after publishing, though, which is why an extension's behavior can change in a later update without the same scrutiny it got at first submission.
What should I do if I think an installed extension is behaving suspiciously?
Remove it immediately from chrome://extensions, then check your accounts for anything unusual if the extension had broad permissions. You can also report it to Google through the Chrome Web Store listing so it can be reviewed.
Do free extensions carry more risk than paid ones?
Not automatically, since many well-regarded extensions like ad blockers and password managers are free. The more useful signal is what the extension needs to do to monetize: an extension with no clear business model that still asks for broad permissions deserves closer scrutiny than a paid tool with a transparent pricing page.
Does an extension's permission list change after I install it?
It can, if the developer pushes an update that requests new permissions. Chrome flags a permission change in some cases, so it's worth checking chrome://extensions after major updates to confirm the access still matches what the extension is supposed to do.