The permission model: why extensions are different
An app on your phone can see your phone. An extension in your browser can see the internet as you — every tab, including your email, your banking session, your documents. The permission that matters most is the broad one, usually phrased as "read and change all your data on all websites." Some categories genuinely need it: ad blockers must see every page to block on it, password managers must fill fields everywhere, page archivers must read what you are looking at. That is legitimate. The problem is the same permission granted by extensions whose job is visibly narrower — a tool that manages one website's data does not need to read all of them.
So the first rule of extension vetting is matching the permission to the job. Broad permission for a tool whose job is broad: fine. Broad permission for a tool whose job is narrow: a mismatch, and mismatches are where risk lives. If an extension's stated job and its permissions do not correspond, that gap is not an accident to be forgiven; it is the single best predictor you have.
Modern browsers increasingly offer narrower permissions — "on click," "on specific sites" — and choosing the narrow option costs almost nothing and shrinks the blast radius dramatically. Take the narrow option when it is offered.
Who made it, and what happened since
Vet the publisher before the product. Established names with a track record and a public website are low-risk regardless of what they make. Unknown publishers are not automatically bad — the extension ecosystem has always been full of excellent one-person tools — but unknown publishers carrying broad permissions is the specific combination to treat with care. Check the publisher's other extensions, their website, and whether the store listing links to anything real.
Then check the trajectory, because extensions have a well-known lifecycle risk: the good extension gets popular, gets acquired, or gets abandoned — and any of the three can change what it does. An acquired extension can turn into the acquirer's data funnel within a version or two; an abandoned one rots against an evolving browser. Read the recent changelog and the recent reviews. If reviews from the last few months mention "what happened to this?" or "it's showing ads now," that is the lifecycle event happening in real time. The extension you installed eighteen months ago is not necessarily the extension that is installed today — permissions can expand in an update, which is why the audit habit matters as much as the install check.
Reading reviews for extensions specifically
Extension store reviews are thinner and gameable in different ways than app store reviews. The user base is smaller, so a dozen coordinated five-star reviews move the average visibly; and the review window is short, so freshness matters even more than elsewhere. Sort by newest and read the last three months as your primary source. Look for the specific complaints that matter in this ecosystem: "my searches redirect," "new tab changed," "it wants more permissions now," "started showing sponsored results." Those phrases are the fingerprints of an extension changing behavior — or being imitated.
One extension-specific check has no equivalent in phone apps: search for the extension's name plus "fake" or "copy." Popular extensions are frequently cloned — a lookalike listing with a similar name and icon, sometimes with thousands of installs harvested from people who clicked the wrong result. Verify the publisher name character by character on anything with a common name, and install from the developer's official website link when one exists.
The categories worth your trust — and the ones to treat carefully
Some extension categories have earned reputations. Password managers from established security companies: high value, and the publishers stake their reputation on behaving. Ad blockers with long histories and public, scrutinized code: genuinely useful and well-audited by their communities. Privacy tools whose entire value proposition is not tracking you: the incentives align, though you should still confirm the tool's claims against independent audits where they exist.
Other categories deserve more care. Anything whose model involves showing you things — shopping helpers, coupon finders, price comparers — earns money through your attention, and some of the less scrupulous ones monetize harder than their listing suggests. "Free" VPNs sold as extensions: most free VPN products are the product; routing all your traffic through an unknown operator's servers is a decision that deserves research, not a one-click install. And social-media enhancers, downloaders, and "productivity" tools of unknown origin should pass a higher bar, because this is the population where hijacked and cloned extensions historically cluster.
The audit: ten minutes, twice a year
Extensions accumulate the way kitchen drawers do, so the habit that keeps you safe is a periodic audit. Open your browser's extension page and ask four questions of each entry. Do I recognize installing this? Do I still use it — deliberately, not just habitually? Do its current permissions still match its job? And has anything about it changed recently — updates, reviews, publisher? Anything failing the first question gets removed immediately; anything failing the others gets a look at its recent history before it stays.
While you are there, tighten what remains: switch any extension still holding broad permissions unnecessarily to the narrow setting, and turn off "allow access to file URLs" for anything that does not visibly need it. Ten minutes, twice a year, and your browser stays an instrument you control rather than an attic of things you granted access to and forgot.
The short version
Extensions are powerful because they see everything you see — so the vetting is proportionally simple: match permissions to the stated job, trust publishers with reputations and trajectories you can read, verify you are not installing a clone, sort reviews by newest, and audit the whole set twice a year. The good extensions — the ad blocker, the password manager, the one tiny tool that saves you a hundred clicks a week — are some of the best software deals in existence. The risk is not in the category; it is in the careless install and the forgotten update. Two minutes per install and ten minutes per audit is the entire price of keeping the upside and dropping the downside.