Browser extension audit: fifteen minutes to fewer hidden permissions

Browsers collect permissions the way a drawer collects cables. An extension installed for one project, a site that once asked to send notifications, an app that signed in with your Google account three years ago: each still has the access you granted once and never revisited. This audit takes about fifteen minutes and removes most of that quiet exposure. Do it now, then put a reminder in your calendar for six months from today.

Why extensions deserve the first look

A browser extension runs inside the program that sees your email, your bank and your company's admin panels. An extension with permission to read and change all your data on the websites you visit can see what you type, including passwords, and can act within your logged-in sessions. Most extensions are harmless, but the permission is the same whether the developer is careful or not.

The risk also changes over time. Popular extensions are sometimes sold to new owners who then push an update with tracking or malicious code to every existing user, and developer accounts can be taken over. In December 2024, according to the company's own analysis, an attacker phished an employee of the data security firm Cyberhaven into approving a malicious OAuth app, used it to publish a poisoned version of the company's Chrome extension, and that version passed store review. Updates install automatically, so an extension that was fine when you installed it can turn bad without you doing anything.

Step 1: remove what you do not use

Allow five minutes. Open the extension list in each browser you use: chrome://extensions in Chrome, edge://extensions in Edge, brave://extensions in Brave, about:addons in Firefox, and the Extensions section of the settings in Safari. For each entry, ask whether you used it in the last month. If not, remove it rather than only switching it off, so it cannot come back by accident.

Look at the rest with fresh eyes and ask three questions of each:

• Who publishes it, and is that still the developer you installed it from?
• When was it last updated, and does the description still match what it does?
• Can you explain in one sentence why you need it? If not, it is a candidate for removal.

Step 2: trim site access

Allow four minutes. In Chrome, Edge and Brave, open an extension's details. Next to the permission to read and change all your data on websites you visit, you can let it run only when you select it, only on specific sites, or on all sites. Choose the narrowest setting that still works: a tool you use on one web app needs only that site, and a screenshot tool can wait until you click it. Firefox lists an extension's permissions on its page in about:addons, where you can withdraw optional ones, and Safari lets you set access per website in its extension settings.

Step 3: apps connected to Google and Microsoft accounts

Allow three minutes. OAuth lets an app use part of your account without your password, for example a scheduling tool that reads your calendar. That access stays in place until you remove it, even if you stopped using the app years ago. In your Google Account, open the overview of third-party apps and services, which Google's help now calls linked apps. Remove anything you do not recognise or no longer use, especially apps with access to Gmail or Drive.

For a personal Microsoft account, open the privacy section of your account and the list of apps and services that can access your data. For a work or school account, the My Apps portal shows the permissions you consented to and lets you revoke them; permissions an administrator granted for the whole organisation can only be removed by the administrator. Removing access stops future use, but data an app has already copied stays with that app.

Step 4: notifications and other site permissions

Allow two minutes. Notification prompts are a common tool of scam sites, which use them to push fake virus warnings long after you left the page. In Chrome, Edge and Brave, open the site settings under privacy and security and review Notifications. In Firefox, go to the Permissions part of the privacy settings; in Safari on the Mac, open the Websites settings. Remove every site you do not want to hear from and consider blocking new requests entirely.

While you are there, check camera, microphone, location and pop-ups. Grant these per site and only to services you use regularly, such as your video call tool.

Step 5: passwords saved in the browser

Allow one minute to decide, plus time to migrate. Built-in browser password managers are much better than reusing passwords, and the major browsers encrypt and sync them. The limits show in mixed setups: passwords saved in one browser are not available in another, sharing with colleagues is limited, and anyone with access to your logged-in computer may be able to view them. A dedicated password manager works across browsers and devices and adds sharing and recovery options.

If you move to a dedicated manager, import the browser's passwords, check that the import is complete, then delete the passwords from the browser and switch off its offer to save new ones. Otherwise you end up with two copies that drift apart.

Sources and further reading

1. Chrome Web Store Help: Manage your extensionssupport.google.com
2. Google Account Help: Manage linked apps and servicessupport.google.com
3. Microsoft Support: Edit or revoke application permissions in the My Apps portalsupport.microsoft.com

General information, checked on 31 October 2026. Test changes on one system first and keep a way back. Found something outdated? Tell the editors.