Quick answer: The fastest way to check a browser extension before installing is to compare the permissions it requests against what it actually claims to do. A screenshot tool asking to “read and change all your data on all websites” is a mismatch worth stopping at. Beyond that, check the developer’s real identity, read recent reviews for suspicious patterns, and know that a Featured or Verified badge does not guarantee safety on its own.
In January 2026, two Chrome extensions impersonating a legitimate AI tool called AITOPIA harvested full ChatGPT and DeepSeek conversation content from roughly 900,000 users and shipped it to an attacker’s server every 30 minutes. One of the two extensions carried Google’s own Featured badge at the time it was discovered. If you have ever assumed a badge or a high install count meant an extension was safe, that incident is worth understanding properly before your next install.
Why Extensions Are a Bigger Risk Than Most People Realise
A browser extension is not a passive add-on. Once installed, it runs inside your browser with whatever permissions you granted at install time, and it can update silently in the background without asking you again. An extension that was genuinely safe last month can change behaviour after an update, after a change in ownership, or after a developer’s account is compromised. Every extension you keep installed is an attack surface, whether you actively use it or not.
Check What Permissions It Actually Needs
This is the single most reliable check. Before clicking install, read the permissions the extension requests and ask whether they genuinely match what the tool does. A calculator extension asking for “access all websites” makes no sense. A screenshot tool requesting the same, broad, unrestricted access, should raise the same question.
Where a choice exists, prefer extensions that request “active tab only” rather than blanket access to every website you visit. This follows the security principle of least privilege: an extension should only be able to see what it genuinely needs to do its job.
Do Not Rely on Badges Alone
Google’s Featured and Established Publisher badges signal that a developer verified their identity or that a listing passed a manual best-practices review, and roughly three-quarters of the Chrome Web Store now carries some form of publisher badge. That makes a badge a reasonable starting signal, but not a guarantee. The AITOPIA impersonation case is the clearest recent proof: one of the two malicious extensions carried the Featured badge at the exact moment it was caught stealing data from hundreds of thousands of users. Treat a badge as one input among several, not a final verdict.
Research the Developer’s Real Identity
Check whether the developer has a genuine website, a public profile, or a visible history of maintaining other extensions. An extension published anonymously, with no verifiable identity behind it, carries meaningfully more risk than one from a developer with a track record you can actually check. If you trust a specific developer, installing directly from their own official site or verified store listing reduces the risk of a look-alike impersonation.
Check for a Recent Ownership Change
Extension ownership can and does change hands, sometimes through a legitimate sale, sometimes through a compromised developer account. A previously trustworthy extension that suddenly requests new, broader permissions after an update, or that shows a recent change in maintainer, deserves a second look before you accept the update.
Read Recent Reviews, Not Just the Star Rating
A high average rating alone does not confirm safety, especially since review sections can be manipulated with fake, clustered positive reviews. Read the most recent reviews specifically, looking for reports of unexpected behaviour, unexplained permission changes, or complaints about data being used in ways the extension never disclosed. A sudden shift in review sentiment around a specific update date is a useful signal that something changed.
Confirm It Uses the Current Manifest Standard
Chrome extensions built on the newer Manifest V3 standard operate under tighter security constraints than the older Manifest V2 format, which is being phased out specifically because of the security and privacy risks it allowed. If you have a choice between two similar extensions, the one built on the current manifest standard is generally the safer default.
A Fast Pre-Install Checklist
- Compare requested permissions against what the extension actually claims to do.
- Check the developer’s identity for a real website or verifiable history.
- Read recent reviews, not just the overall star rating.
- Don’t treat a badge as a final answer, only as one supporting signal.
- Uninstall extensions you no longer actively use, reducing your overall attack surface.
If You Think You Already Have a Malicious Extension Installed
- Open your browser’s extensions page and review every installed extension, including ones you forgot about.
- Remove anything you do not actively recognise or use, particularly anything with broad “all websites” access.
- Check for unexpected permission changes on extensions you are keeping.
- Change passwords for any sensitive account you accessed while a suspicious extension was active.
- Run a security scan on your device as a precaution.
Common Questions
Does a Featured or Verified badge mean an extension is safe?
No. It confirms the developer verified their identity or passed a manual review at some point, but it is not a live safety guarantee. A Featured-badged extension was found stealing user data from hundreds of thousands of people in January 2026.
What is the single biggest red flag when installing an extension?
A mismatch between the permissions requested and what the extension actually needs to do its job, such as a simple utility tool asking for access to all your browsing data.
Can a safe extension become unsafe later?
Yes. Extensions update automatically and can change behaviour after an update, after an ownership change, or if a developer’s account is compromised. Review your installed extensions periodically, not just at install time.
Is it safer to install extensions only from the official store?
Generally yes, since official stores apply some review process, but this is not a full guarantee on its own, so combine it with checking permissions, the developer’s identity, and recent reviews.
How many extensions should I keep installed?
As few as genuinely useful. Every installed extension is an additional attack surface, so removing ones you no longer actively use reduces your overall risk with no downside.
The Bottom Line
Browser extensions carry more risk than most people assume, precisely because they run quietly in the background with real access to your browsing data. Badges and star ratings help, but they are not proof of safety, as the AITOPIA case demonstrated clearly. Checking permissions against actual function, verifying the developer, and reviewing your installed extensions periodically closes off the vast majority of real risk, and takes only a couple of minutes each time you consider adding something new.