Browser extensions: the quiet danger (and how to clean up)

By Ricardo Da Silva, RSCOM · 10 October 2026

A PDF converter, an ad blocker, a screenshot tool: browser extensions are handy and install in one click. But an extension can read everything you display, including your e-mail, your e-banking and the passwords you type. Malicious extensions are regularly discovered in the official stores, sometimes after being installed thousands of times.

How an extension becomes dangerous

• Fake extension: it imitates a well-known tool (crypto wallet, translator, ad blocker).
• Buy-out: an honest, popular extension is sold to a new owner who adds spyware in an update.
• Excessive permissions: “read and change all your data on all websites” when it does not need to.

Tutorial: clean up in 5 minutes

1. Open the list: type edge://extensions in Edge, chrome://extensions in Chrome or about:addons in Firefox.
2. Remove anything you do not recognise or no longer use. The fewer, the better.
3. Check the permissions of the remaining extensions (“Details”): a notepad does not need access to every site.
4. Check the publisher and recent reviews: an unknown publisher or recent reviews reporting ads or redirects are bad signs.
5. If a suspicious extension was installed: remove it, change the passwords typed in the browser from another device, and have the computer scanned.

In the company: no more leaving it to chance

With Microsoft Intune or group policies, the company can block all extensions except an approved list (for example the password manager and the video-conferencing tool). It is simple to set up and closes a heavily used entry point.

• A list of approved extensions, validated by the person in charge of IT.
• The browser always up to date (restart it when it asks: it is often a security fix).
• A business password manager rather than passwords saved in the browser.

Read also

• Two-factor authentication is no longer enough: 5 blind spots to know
• Slow Wi-Fi at the office: the real causes (and is Wi-Fi 7 worth it?)
• Personal computers and external providers: how to protect company data

← All articles