Your Browser Extensions Can Read Everything You Do

You installed it to convert one PDF, three years ago. It is still there, and it can read your bank.

What the permission actually says

“Read and change all your data on all websites” is the most commonly granted browser permission and one of the least understood. It means the extension can see every page you open — including the contents of your webmail, your bank, your health records — and can modify what appears on them.

That is not a hypothetical description of what it could do. It is a description of what it is permitted to do at any moment, without further prompting.

Most extensions with that permission are entirely honest and need it for their actual job. That is precisely what makes the risk hard to see.

The part that surprises people: extensions get sold

An extension you vetted in 2022 is not necessarily made by the same people today. Small popular extensions get bought — sometimes specifically for their install base and their permissions — and the update ships silently through the same auto-update mechanism that delivers security fixes.

Nobody emails you when an extension changes hands. There is no notification, and the permissions do not have to be re-granted, because they were granted to the extension, not to its owner.

A five-minute audit

Open your browser’s extensions page and go through the list once.

Anything you do not recognise: remove it. Not disable — remove. You will find things you installed for a single task.
Anything you have not used in six months: remove it. You can reinstall in thirty seconds if you turn out to need it.
For what is left, look at the permissions. A password manager needing broad access is expected. A theme, a converter or a coupon finder wanting to read every page is worth a second thought.
Prefer “on click” access where the browser offers it. Modern browsers let you restrict an extension to running only when you click it. For most tools that is enough, and it turns permanent access into occasional access.

Do the same for connected apps

Same problem, different list: the third-party apps you signed into with Google, Microsoft or Apple, some of which can read your mail or your files. Those live under your account’s security settings and accumulate exactly the same way — one task, years ago, still connected.

Then stop thinking about it

This is not something to worry about continuously; it is something to check occasionally. Attach it to something you already do monthly, spend five minutes, and let it go.

It is one of four checks in the ten-minute digital tidy — free to read — alongside the one that matters even more: proving your backup can actually restore a file. And if you are setting up a new machine, the free checklist puts these in the order that saves doing half of them twice.