How to Audit Browser Extensions for Supply-Chain Risk

Most people install browser extensions the way they install phone apps: quickly, for one small task, and then forget about them. A coupon finder, a grammar checker, a tab manager, a screenshot tool. Each one feels harmless.

But an extension isn’t a static piece of software. It updates silently, it can change owners, and it often has permission to read every page you open. That makes extensions one of the most overlooked supply-chain risks in modern computing, for individuals and organizations alike.

Why Extensions Are a Supply-Chain Risk

A software supply-chain attack targets something you already trust instead of attacking you directly. Browser extensions are an ideal vehicle for that, for three reasons.

They update automatically. Once installed, an extension receives updates in the background. If a malicious version is published, it can reach every user within hours, with no action on their part.

They change hands. Popular extensions with large user bases are valuable assets. Developers sometimes sell them, and the new owner inherits the trust of every existing user. The Great Suspender, a widely used tab management extension, is a well-known example: after it changed ownership, it was removed from the Chrome Web Store in 2021 and flagged by Google as containing malware.

Developer accounts get hijacked. In December 2024, attackers phished the developers of several legitimate Chrome extensions, including one from security company Cyberhaven, and used their access to push malicious updates. The compromised versions were designed to steal session data and credentials, with Facebook advertising accounts among the main targets.

In each case, users did nothing wrong. They installed a trusted tool, and the tool changed underneath them. That is one reason security-conscious teams use tools like the Afina anti-detect browser, which keeps each profile’s cookies, storage and extensions strictly isolated, so a single compromised extension can’t reach every account.

What an Extension Can Actually Access

When you install an extension, the browser shows a permissions prompt. Most people click through it. It’s worth reading, because the most common permission is also the most powerful: “Read and change all your data on all websites.”

An extension with that permission can, in principle:

• read the content of every page you visit, including email, banking and internal company tools;
• see form fields as you type, including some login details;
• access cookies and session data for sites it’s allowed to run on;
• modify pages, inject scripts or redirect links.

Many legitimate extensions genuinely need broad access to work. That’s exactly why a compromised one is so dangerous: it already has the permissions it needs to cause harm.

Browser vendors and tool makers are responding in different ways. Chrome’s Manifest V3 restricts extensions from loading remotely hosted code, which makes some attacks harder. Some browsers built for professional teams, such as Afina, go further by cryptographically signing extensions and scripts against silent tampering and encrypting profile data on the user’s device under a zero-knowledge security model. Whatever browser you use, the goal is the same: make it harder for a changed or malicious extension to run unnoticed, and limit what it can reach if it does.

How to Audit Your Extensions in 15 Minutes

You don’t need special tools to get a clear picture of what’s running in your browser. A short audit every few months is enough for most people.

1. List everything installed. Open your browser’s extensions page (chrome://extensions in Chrome, edge://extensions in Edge, about:addons in Firefox) and look at the full list, including disabled extensions.
2. Remove what you don’t use. If you can’t remember why an extension is there, uninstall it. Every extension you remove is one less thing that can be compromised.
3. Check permissions. For each remaining extension, open its details and review what it can access. Where your browser allows it, restrict site access to “on click” or to specific sites instead of all websites.
4. Check the publisher. Look at who publishes the extension and whether that has changed. A new publisher name on a long-standing extension is a reason to look closer.
5. Read recent reviews. A sudden wave of complaints about ads, redirects or strange behavior often appears soon after an extension is compromised or sold.
6. Separate sensitive activity. Keep banking, admin dashboards and work accounts in a separate browser profile with as few extensions as possible. Extensions installed in one profile can’t see what happens in another.

Policies for Organizations

For businesses, extensions are a shadow IT problem. Employees install tools to save time, and security teams often have no inventory of what’s running on company browsers.

A few controls make a big difference:

• Use an allowlist. Chrome Enterprise and Microsoft Edge support policies that allow only approved extensions and block everything else. Firefox offers similar enterprise policies.
• Control permissions centrally. Policies can block extensions that request specific high-risk permissions, or restrict which sites approved extensions may run on.
• Review approved extensions regularly. Treat extensions like any other third-party software: assess them before approval, recheck them periodically and remove those that are no longer needed.
• Isolate high-value access. Staff who manage advertising accounts, finance systems or customer data should work in dedicated browser profiles with a minimal, approved set of extensions.
• Include extensions in incident response. If an extension is reported as compromised, you should be able to identify affected users quickly, remove the extension and invalidate sessions on the services it could reach.

Warning Signs an Extension Has Gone Bad

Compromised extensions don’t always announce themselves, but a few signs are worth acting on immediately:

• new ads, pop-ups or redirects appearing on sites that never had them;
• your search engine or homepage changing without your input;
• an extension suddenly requesting new permissions after an update;
• unexpected logouts, security alerts or login attempts on your accounts;
• the extension disappearing from the official store, which often happens after a malware report.

If you notice any of these, remove the extension, sign out of active sessions on important accounts, change passwords for services you used in that browser and review recent account activity.

Conclusion

Browser extensions sit in one of the most privileged positions on any device: inside the browser, next to your email, your work tools and your financial accounts. That convenience comes with real supply-chain risk, because the extension you installed last year may not be the extension running today.

The defense isn’t to avoid extensions altogether. It’s to treat them like any other software with access to sensitive data. Keep fewer of them, review their permissions, watch for ownership and behavior changes, and separate your most sensitive activity from everyday browsing. A short audit a few times a year closes one of the easiest doors attackers have into your accounts.