What a browser extension can access

Updated: Oct 28, 2026

Browser extensions are small programs that run inside the browser and change how it behaves: blocking advertisements, filling passwords, translating text, saving articles. Because they live inside the same program you use for banking, email and work, the access they receive is unusually broad. A single sentence in the install dialogue, “read and change all your data on all websites”, grants more reach than most apps on your phone will ever have. This article explains what extensions can see and do, how that access is abused, and how to keep the useful ones without accepting the risk of the rest.

How extension permissions are requested and used

An extension declares the permissions it needs in a manifest file. The browser shows a summary at install time, and from then on the extension can use those capabilities without further prompts. The most important categories are:

• Host permissions decide which sites the extension can interact with: a single domain, a list, or every site. With access to a site, the extension can read the full page including text you type, modify what is displayed, and make requests on your behalf while you are logged in.
• Tabs and history let an extension see which pages are open and where you have been.
• Cookies and storage allow reading session tokens, which is effectively the same as having your login.
• Web requests let it observe or block network traffic, which is how content blockers work.
• Downloads, clipboard, bookmarks, notifications and other specific capabilities are granted individually.

Extensions run with a separate background process plus content scripts injected into pages. A content script can read the password you type into a login form before it is ever encrypted, because encryption happens later, when the browser sends the request. Nothing about HTTPS protects a page from an extension that is already inside it.

How access is abused

Most extensions are honest. The problem is that an honest extension can change hands or be compromised, and the permission grant does not expire.

• Sale to a new owner. Extensions with hundreds of thousands of users have been bought by companies that then pushed updates injecting tracking, affiliate links or advertising into every page.
• Compromised developer account. Attackers who phish a developer can publish a malicious update through the official store. Users receive it automatically.
• Data harvesting as a business model. “Free” extensions have been found collecting complete browsing histories and reselling them, sometimes with enough detail to identify individuals.
• Look-alike clones. Copies of popular extensions with similar names and icons appear in stores and rely on users not checking the publisher.
• Session theft. An extension with cookie access can copy your logged-in session to an attacker’s machine, bypassing your password and, in many cases, two-factor authentication.

Browser vendors have responded with review processes, stricter manifest rules and the ability to restrict host access after installation, but the fundamental trade-off remains: the more useful an extension is across all sites, the more it can see.

Everyday examples

A password manager legitimately needs access to every site, because it must fill credentials wherever you log in. That access is justified by the function and by the reputation and business model of the vendor. A coupon finder that requests the same access is a different matter: it needs to see shopping pages, but “all sites” gives it your email and bank as well. A screenshot tool needs the current tab when you click it, and nothing else; if it asks for continuous access to all sites, ask why.

Auditing the extensions you already have

• Install fewer extensions. Each one is a permanent guest inside every page it can reach.
• Prefer extensions from publishers with a clear identity, an established reputation and a business model you understand.
• Use the browser’s per-extension settings to restrict site access to “on click” or to specific domains where the function allows it.
• Do not enable extensions in private windows unless they are essential there.
• Review your extension list every few months; remove anything you no longer use or do not recognise.
• Consider a separate browser profile with no extensions for banking and other sensitive accounts.
• Keep the browser updated; permission model improvements arrive with new versions.

Frequently asked questions

Does the store review process make extensions safe?

It removes obvious malware and enforces policy, but reviews are largely automated and cannot judge whether a future update will be honest. Treat store presence as a minimum bar, not a guarantee.

Can an extension see my passwords?

If it has access to the page where you type them, yes. It can also read saved passwords autofilled into forms on those pages. This is why host permissions matter more than any other setting.

Are extensions on mobile browsers the same?

Mobile browsers support far fewer extensions and often with narrower permissions, which is one reason they are less frequently targeted. Where extensions exist, the same principles apply.

An extension with access to a page is inside your session on that page; grant that access as carefully as you would hand over a password.

In short: Extensions can read and change everything on the sites they are allowed to reach, including what you type and your logged-in session. Keep the list short, restrict site access where possible, and re-evaluate when an extension changes hands or requests new permissions.