September 24, 2026 · by David Gilbert · 3 min read · Cyber Security
People who are genuinely careful about passwords, multi-factor authentication, and device security routinely install browser extensions with sweeping, broad permissions and then simply never think about them again. It's one of the more common, least-discussed security gaps I find when reviewing a client's actual setup, and it deserves considerably more attention than it generally gets.
Why Browser Extensions Are a Genuinely Bigger Risk Than People Assume
A browser extension with broad permissions can potentially see everything you do in that browser — passwords being entered, banking sessions, private messages, literally anything happening on-screen. Most people install one for a single, specific, useful feature and never reconsider afterwards just how much access they actually granted it in the process, often without ever properly reading what was actually being requested at install time.
How Extensions Quietly Become a Real Problem Over Time
An extension can be completely legitimate and trustworthy at the moment of installation, and ownership or control can change hands later — sold to a different company, or quietly compromised in some other way — without the average user ever noticing the change at all. The permissions you originally, reasonably granted don't automatically get re-evaluated just because the entity actually controlling that extension has changed since you first installed it.
What I Find When I Actually Check a Client's Extensions
Routinely, extensions installed years ago for one specific, narrow purpose that's long since stopped mattering, still running, quietly, with the exact same broad permissions originally granted, never reconsidered or revisited since. Often, the person genuinely can't remember why they installed it at all, which is, on its own, a fairly clear signal it's worth removing regardless of whether it's currently actually causing any visible harm.
What I Actually Recommend
- Periodically review every installed extension, removing anything you're not genuinely, actively still using for a clear, current purpose.
- Check permissions before installing anything new, and be specifically wary of any extension requesting considerably broader access than its stated, advertised purpose would obviously seem to require.
- Favour extensions from genuinely well-known, reputable developers with a real, visible track record, over obscure ones promising an impressively long feature list for a niche need.
- Use a separate browser, or browser profile, for genuinely sensitive activity like banking, with as few extensions installed there as you can reasonably manage.
Why This Gap Persists Even Among Otherwise Careful, Security-Conscious People
Extensions feel low-stakes and convenient at the actual moment of installation, in a way that a sketchy email attachment or an obviously suspicious link clearly doesn't. That low-stakes feeling at install time is exactly why this specific risk gets consistently underestimated, even by people who are genuinely careful, thoughtful, and security-conscious about more obviously risky categories of behaviour elsewhere.
The Bigger Pattern Worth Noticing Here
A lot of real, practical security risk doesn't come from one single dramatic mistake — it comes from a slow, quiet accumulation of small, individually reasonable-seeming decisions, like installing one more convenient browser extension, none of which feels remotely risky at the actual moment you make it. The fix isn't paranoia about every single extension that exists. It's a periodic, deliberate review, treated as a normal, routine habit rather than something that only happens by sheer accident.
What I'd Actually Suggest Doing This Week
Open your browser's extension list right now and look properly, honestly, at what's actually installed and what permissions each one currently holds. I'd genuinely bet you find at least one thing you don't remember installing, can't clearly explain the current purpose of, or simply no longer need — and removing it costs you nothing except a couple of genuinely worthwhile minutes.