The browser extension is the most powerful piece of software most people install carelessly: a free coupon-finder or tab-organiser that can, depending on its permissions, read every page you visit — including your banking and your email. Understanding how browser extensions work converts installation from a shrug into a decision: what code runs where, what the permission list actually grants, and how good extensions go bad. This explainer opens the hood on the browser’s most trusted — and most abusable — citizens.
The Anatomy: Three Kinds of Code in One Package
An extension is a bundle of web code (HTML, CSS, JavaScript) plus a manifest — a declaration file that tells the browser what the extension wants to do and where. Inside, the work divides into three roles. Content scripts inject into the web pages you visit, reading and modifying them in place: highlighting text, blocking ad elements, filling forms, rewriting prices. Background code (a service worker in modern browsers) lives outside any page, listening for events, holding settings, talking to servers, and coordinating the other parts. Popups and options pages provide the visible interface — the little window when you click the toolbar icon. The security insight is in the division: content scripts see everything a page contains — every word, every form field, every password box — because modifying a page requires standing inside it. An extension with permission to run content scripts on all sites is, architecturally, a trusted observer of your entire browsing life. That is not inherently sinister — ad-blockers and password managers need exactly this — but it is inherently serious.
Permissions: the Contract You Actually Sign
Because the architecture is powerful, browsers gate it behind declared permissions, and the permission list at install time is the only contract you will ever see. Read it as such. Modest requests match modest tools: “read and change data on [one named site]” for a site-specific helper; storage for settings; tabs for an organiser. Sweeping requests demand explanation: “read and change ALL your data on ALL websites”, “read your browsing history”, “communicate with programs on your computer” — each is a capability with legitimate uses (a password manager genuinely needs broad page access) and catastrophic abuse potential, and the question is never the permission itself but whether THIS tool’s job justifies it. A flashlight-simple extension asking for everything is the digital equivalent of a locksmith demanding your house deed. Modern browser platforms (notably the Manifest V3 shift) have narrowed what extensions may do by default — restricting remote code and broadening user control — a platform-level admission that the old contract was too easy to abuse.
How Good Extensions Go Bad
The subtler risk is temporal: the extension you audited was safe, and the one running today is a different product. Extension ownership is a market — popular free extensions with millions of users receive purchase offers precisely because distribution is the valuable asset, and a new owner can ship an “update” that adds data collection or ad injection to an installed base that granted the permissions years ago and never looks again. Abandoned extensions rot the other way: unpatched vulnerabilities in software your browser still trusts fully. And the store listings themselves host impostors — copycat extensions wearing a famous tool’s name and icon, distinguishable only by publisher details and install counts most users never check. The defences are habits: periodically review installed extensions and remove any you cannot justify in one sentence; prefer tools from publishers with real identities and revenue models you can name (paid, or part of a product you pay for); treat a sudden permission-expansion update as a re-install decision, not a formality; and install from the official store listing of the genuine publisher, reached from the publisher’s own site. Powerful software deserves the same provenance discipline our companion explainer recommends when assessing foldables in how foldable phones work — capabilities first, marketing last.
A Five-Minute Audit for the Extensions You Already Have
Open the browser’s extension manager now and run the list. For each extension answer four questions: Do I use it weekly? (No → remove; disabled-but-installed still holds permissions.) Does its job justify its site access? (Check per-extension settings — modern browsers let you restrict an extension to specific sites or to run only when clicked, a setting that neuters most risk from keepers you use on two sites.) Who publishes it, and is it still maintained? (An update history within the year is the pulse.) Would I install it today, knowing what it can see? (Hesitation is an answer.) Most readers finish this audit having removed a third of their extensions, restricted most of the rest, and lost nothing at all — the coupon tool they never open can go, and the internet gets measurably less access to their life.
The Balanced Verdict
Extensions are also genuinely wonderful: they block the web’s worst advertising, manage passwords into safety, translate the world, and bend inflexible sites to their users’ needs. The goal of this literacy is not abstinence but proportion — treat each installation as hiring a member of staff who will stand inside your browser reading over your shoulder, because architecturally that is precisely the appointment. Knowing how browser extensions work — content scripts inside your pages, background code beyond them, permissions as the contract, updates as a change of employer — turns the app’s smallest install button into what it always was: a decision about trust, best made awake.
