In short: A browser extension runs with almost the same rights you have. With the "access to all sites" permission it can see the contents of every tab you open — from online banking to email — and silently capture passwords, session cookies, or swap out addresses. An extension can be malicious from day one, or turn bad later after a change of owner or an auto-update. A VPN encrypts your traffic to the provider, but it does nothing against an extension working inside the browser — there you need a permissions review, removal of anything unused, and "run on click" mode. Below: how to spot a dangerous extension, audit the ones already installed, and what to do right now.
Why an extension means access to your data
A normal website is isolated: the browser keeps it in a sandbox and blocks it from other tabs' data. An extension is different. It is a program you install inside the browser, and on install it asks for permissions. The phrase "Read and change all your data on the websites you visit" (the <all_urls> permission in the manifest) means exactly this: the extension receives the contents of any page you open, along with whatever you type on it.
Through so-called content scripts, an extension injects into the page and works with form fields, text, and cookies on par with the site itself. Chrome's Manifest V3 standard limited the old intercepting webRequest API and shifted request filtering to declarative rules, but extensions still retain read access to open pages — and that is the main privacy risk. So a theme-changing extension that asks for access to all sites is already a red flag: the feature doesn't need that much power.
The second key point is updates. Extensions update automatically and silently. The code you install today can become different tomorrow without any action from you. That is what makes extensions a convenient entry point for anyone hunting for data.
How extensions steal data and money
A malicious extension acts quietly: the interface stays the same while the harmful logic hides in the background. The main techniques:
- Session cookie theft. The extension reads your session files and sends them to a remote server. With an active session, an attacker doesn't need your password — they log in as you, bypassing even two-factor checks.
- Capturing what you type. Logins, passwords, card numbers, and codes are read from form fields at the moment of entry, before the page encrypts and sends them.
- Rewriting page content. The extension edits the page: it substitutes its own crypto wallet address for the one you copied, changes details in a payment form, or inserts a phishing button.
- Ad injection and affiliate swaps. Third-party ads get injected into pages, and affiliate tags are appended to store links — you generate revenue for the extension owner without knowing it.
- Redirects and tracking. The extension logs every address you visit and sells that history, and sometimes redirects you to fake sign-in pages.
A separate danger is extensions that genuinely do their advertised job but also collect your browsing history "for analytics." Technically not a virus — in practice, constant surveillance of everything you open.
How a harmless extension turns malicious
An extension can stay clean for years and then abruptly change behavior. Typical scenarios:
- Change of owner. The author of a popular extension sells it, and the new owner adds data collection with the next update. An audience of thousands comes bundled with the purchase.
- Embedded third-party code. A developer adds an ad or analytics module to make money, and it starts pulling more than declared.
- Compromise of the developer's account. Through phishing, an attacker takes over the store account and publishes a malicious version under the author's name — users receive it as an ordinary update.
This is why an extension's presence in an official store is no guarantee of safety: malicious add-ons often pass moderation and live there for a long time, and a version can turn dangerous only after you install it. The same "store is not a guarantee" principle applies to mobile apps too — we covered it in our breakdown of malicious VPN apps.
Signs of a dangerous extension
Before installing, and when auditing what's already there, judge extensions by several signals. A mismatch between requested rights and function should raise concern: a simple tool like a unit converter or a dark theme has no reason to need access to all sites, the clipboard, or tab contents. Other details are suspicious too — the extension recently changed its name or developer, it has no clear privacy policy, its reviews look uniform and inflated, and its name and icon nearly copy a known popular add-on. That resemblance is a classic lure: the user installs the fake instead of the original.
Watch behavior after install as well: new tabs open on launch, the default search engine changes, pop-up ads appear where there were none. These are common traces of an extension tampering with pages. The logic of judging permissions overlaps with how sites track you through your browser fingerprint.
How to audit installed extensions
Run a review at least every couple of months and after each new install. The steps are roughly the same across Chromium-based browsers and Firefox:
- Chrome and Edge: open
chrome://extensions(in Edge,edge://extensions), enable developer mode, and review the list. For each extension, click "Details" and check the permissions and "Site access" section. - Firefox: open
about:addons, the "Extensions" tab, and check permissions in each add-on's properties. - Remove anything you didn't install deliberately or don't use. An unfamiliar extension is reason enough to delete it without a second thought.
- For needed but "greedy" add-ons, restrict access: instead of "on all sites," choose "on click" (activeTab) or a list of specific domains. Then the extension sees a page only when you launch it yourself.
Separately, check whether your start page and default search have been changed — such a swap often survives removing the culprit and must be fixed in browser settings by hand.
Does a VPN protect against malicious extensions?
Here it's important to be honest: a VPN by itself does not protect you from a malicious extension. A VPN encrypts traffic between your device and its server — that shields data from your provider and from an eavesdropper on a public network. But an extension works inside the browser, before traffic enters the tunnel: it sees the open page in its original form, so channel encryption is no obstacle to it. If you want to see where the tunnel does and doesn't help, our breakdown of a man-in-the-middle attack shows the network side clearly.
Protection against these threats is layered. Here's what actually helps against typical extension techniques:
| Threat | Does a VPN help? | What actually protects |
|---|---|---|
| Extension reads the open page | No | Audit and remove unneeded extensions, "on click" mode |
| Session cookie theft | No | Fewer extensions, signing out of accounts, clearing sessions |
| Password captured from a form | No | Password manager with domain-bound autofill, 2FA |
| Traffic interception on open Wi-Fi | Yes | A VPN — this is where it belongs |
| Provider tracking which sites you visit | Yes | A VPN encrypts DNS and traffic to the server |
So extensions and a VPN cover different areas. Extension hygiene protects what happens inside the browser; a VPN protects the channel outward — traffic on public networks and from your provider. If you want a VPN as a separate, auditable, no-logs layer, see LiMP VPN pricing. But a built-in "VPN" inside some random browser add-on is a bad idea: it is the same kind of extension with access to your pages — exactly the risk this whole article is about. Downloading a VPN itself carries its own pitfalls, which we covered in how to download a VPN safely.
What to do: a security checklist
- Open the extensions list in your browser and remove anything you don't use or don't remember installing.
- For the rest, check permissions: if the rights are broader than the function, restrict site access to "on click" mode or specific domains.
- Install extensions only from the official store and only from a known developer — and even there, read the permissions and recent reviews.
- Never install add-ons from direct links in emails, ads, or chats — that's a common delivery channel for fakes.
- Keep a separate "clean" browser profile with no extensions for banking and payments.
- Turn on two-factor authentication everywhere you can and store passwords in a manager — so one extension can't unlock all your accounts at once.
- After removing a suspicious extension, check your start page and default search, and change passwords to important services if needed.
FAQ
Can extensions steal passwords if I use a password manager?
A manager reduces the risk: it autofills a password only on the genuine domain and protects against phishing copies. But if an extension reads the already-open page, it can capture the data from the form after autofill. So a password manager is a necessary but not sufficient layer; the key is not keeping unnecessary extensions in the browser.
Are extensions from the official Chrome Web Store safe?
The store lowers the chance of hitting an outright virus, but doesn't guarantee safety. Malicious add-ons pass moderation, and a clean extension can turn dangerous after a change of owner or an update. An official source is a required but insufficient condition.
Do malicious extensions work in incognito mode?
By default extensions are disabled in incognito, but many users manually allow them there. If that permission is granted, the extension sees pages in a private window just as in a normal one. Incognito hides history on the device, but doesn't limit an add-on's rights.
Will antivirus detect a malicious extension?
Not always. Antivirus tools catch executable files better than add-ons that formally behave like allowed code inside the browser. A clearly malicious extension may get flagged, but a "gray" one collecting data for analytics is often missed. A manual permissions review is more reliable.
Should I remove extensions I don't use?
Yes. Every installed extension is extra code with access to your pages and a potential point of compromise, even if it behaves honestly right now. The shorter the list, the smaller the attack surface and the easier it is to notice something out of place.
Can a malicious extension see my traffic if a VPN is on?
Yes. A VPN encrypts traffic after it leaves the browser, while the extension works earlier — right on the page, where data is still in the clear. To the extension it makes no difference whether a VPN is on: it reads what you see on screen.