Browser extensions are the most trusted software on your machine. You install one to block ads or find coupon codes, it asks for a permission or two, you click Add, and then it lives in your toolbar for years, reading every page you load. Most add-ons are exactly what they claim to be. Some are not, and the warning signs are usually printed in a permissions list almost nobody reads. Here is how to read it, and how to clear out anything that has not earned the access it holds.

Why extensions deserve a second look

An extension runs inside your browser, which is where you do your banking, your work email, and your shopping. That position gives it visibility that a normal app does not have: the pages you open, the forms you fill, sometimes the text you copy and the files you download. Add-ons also update themselves without asking, so the version you approved last year is not necessarily the version running today. Developers sell extensions, publishers change, and code gets rewritten. A quick audit is the only way to know what you are actually running.

Open the extensions page and take inventory

Every browser has a single screen that lists everything installed. Find yours, then go through the list one item at a time:

• Chrome, Edge, Brave, Opera: type chrome://extensions or edge://extensions into the address bar. Turn on Developer mode only if you want the extension IDs and file paths shown.
• Firefox: open about:addons and switch to the Extensions panel.
• Safari: on macOS, Settings then Extensions; on iPhone and iPad, Settings then Safari then Extensions.

For each entry, open the Details page. That is where the permission warnings live, along with the site access setting and the publisher name. If you find an extension you cannot identify, that is your first removal. Unknown does not mean harmless.

Read the permissions like a job description

Modern browsers phrase these warnings in plain language. The ones that deserve a pause:

• "Read and change all your data on all websites" – full access to page content, including the pages where you log in. Password managers and content blockers often need it; a calculator, a theme, or a wallpaper tool does not.
• "Read your browsing history" – the extension can see addresses you visit, including tabs it never touches.
• "Read and modify data you copy and paste" – clipboard access. People copy passwords, recovery phrases, and payment details all day long.
• "Manage your downloads" or "Allow access to file URLs" – downloads and locally opened documents.
• "Change your proxy settings" or "Control network requests" – traffic routing. VPN and ad-blocking tools have a reason to ask; most others do not.
• "Communicate with cooperating native applications" – a bridge to software outside the browser. Rare, and worth understanding before you keep it.

The test is simple: does the permission match the job? A screenshot tool reading your clipboard makes sense. A currency converter that wants to read every site does not.

Narrow the access you already granted

Chromium browsers let you change site access from "on all sites" to "on click" or a specific allowlist. On the extension's Details page, look for Site access and pick the narrowest option that still works. A coupon finder only needs to run on shopping domains. A grammar checker only needs your document editor. Some features will stop working on sites you did not allow; that is the point, and you can always widen it temporarily.

Red flags the permission list will not show you

Permissions are necessary but not sufficient. A few more things to check while you are on the Details page:

1. Publisher changes. If the developer name no longer matches what you remember, or the extension was clearly built by one person and now belongs to a company you have never heard of, treat it as new software.
2. Recent reviews, sorted by newest. Complaints about redirects, injected ads, a changed search engine, or a new toolbar are the classic signature of an extension that changed hands.
3. The privacy practices panel in the store listing. It states whether data is collected, sold, or shared, and whether a privacy policy exists. "Not provided" plus broad permissions is a bad combination.
4. Long silences. An extension with a large user base and no updates in years is a target, because abandoned listings get bought. The Great Suspender is the well-known cautionary tale: it was removed from the Chrome Web Store after a change of ownership brought unwanted code with it.
5. Duplicates. Two tab managers, three coupon tools, four PDF converters. Each one is another set of permissions to trust.

Shrink the blast radius of extensions you keep

Deleting everything is not the goal. Useful extensions exist. Keep them, but limit what they can reach:

• Set site access to on-click or a short allowlist.
• Run extension-heavy tools in a separate browser profile from the one you use for banking and email. A second profile takes two minutes to create and keeps cookie and history data apart.
• Disable extensions you use once a month. A disabled extension cannot read a page.
• Keep the browser updated so extension updates arrive quickly, and re-read the permission list after a major update. Browsers now disable extensions that request new permissions until you approve them, so treat that prompt as a real decision rather than a click-through.
• Prefer built-in features where they exist: reader mode, tracking protection, password managers, and PDF viewers are all native now.

Removing one without leaving a mess

Disable the extension first and use the browser normally for a day. If nothing breaks, remove it. Before deleting, check whether it stored anything locally that you want, such as saved sessions, notes, or reading lists; some tools offer an export option, and some keep data only in the extension's own storage, which disappears with it. After removal, revisit any setting it may have changed, including your default search engine, homepage, and new tab page.

If an extension with full page access turns out to have been plainly malicious, go a step further: sign out and back in to important accounts, review active sessions, and change passwords for anything you typed while it was installed. That is proportionate for a real compromise, and unnecessary for a routine cleanup.

A ten-minute routine, four times a year

Add this to the calendar next to your password review and it never becomes a crisis:

1. Open the extensions page and list what is installed.
2. Open Details on each one and re-read the permissions.
3. Switch site access to on-click wherever the extension still works that way.
4. Sort reviews by newest and skim for complaints about ads or redirects.
5. Remove anything you have not used in the past month.
6. Ask yourself, for each survivor, whether the browser can already do this natively.

Your browser profile is effectively the master key to everything else you own, and extensions are the keys you handed out. Hand out fewer, and check periodically that the ones you kept still deserve them.

Photo: Jakub Zerdzicki / Pexels