The Chrome Extension Risk Landscape
Chrome extensions have access to some of the most sensitive data on your computer - browsing history, form inputs, cookies, and sometimes network requests or file system access. A malicious or poorly-written extension can exfiltrate your credentials, inject ads into pages you visit, track your browsing habits, or modify your browser settings without your consent.
Google's Chrome Web Store review process catches many threats, but it is not foolproof. In 2023, researchers at Stanford University identified over 200 extensions with over 80 million total installs that were collecting user browsing data beyond what their descriptions disclosed. The problem is not limited to small, obscure developers - well-known extensions have been acquired by bad actors who then push updates that add tracking code.
This doesn't mean you should avoid extensions entirely. The productivity and security benefits of well-chosen extensions far outweigh the risks. What it means is that you should approach each installation with the same critical eye you would apply to downloading any new software for your computer.
The Permission Evaluation Framework
Permissions are the single most important signal of an extension's safety. Chrome's permission system is granular - extensions must explicitly request access to specific capabilities, and Chrome displays these requests at install time. The key is knowing which permissions are reasonable for which types of extensions and which should give you pause.
Storage is the most common and least concerning permission. Almost every extension that saves settings or data needs it. FocusGuard uses storage to save your time-tracking data, block lists, and configuration entirely in Chrome's local storage. No data is ever transmitted to an external server.
Tabs allows an extension to query and manipulate browser tabs, including reading tab URLs. A website blocker needs this to identify which site you're on. A password manager needs it to match login forms to saved credentials. A joke extension that just adds a funny sound effect probably does not.
Host permissions (access to specific websites or all websites) are the most powerful and risk-prone. An extension can request access to a single domain, a set of domains, or every website you visit (<all_urls>). A website blocker like FocusGuard needs host permissions for the domains you want to block. A password manager needs them for the sites where you have credentials. A simple alarm clock extension does not need to read the contents of your banking page.
Clipboard read, downloads, identity (access to your Google account), and native messaging (communication with software outside the browser) are high-risk permissions that should be scrutinised especially carefully. If an extension requests any of these, you should have a clear understanding of why - and the extension's description should explain the need transparently.
How to Read a Permission List
When you click "Add to Chrome," a dialog appears showing two types of information: the permissions the extension needs and the sites it can access (if applicable). Manifest V3 extensions show a cleaner permission dialog than older V2 extensions, grouping permissions into categories like "Read and change your data on websites you visit" and "Display notifications."
To see the full permission list before installing, click the dropdown arrow on the permission dialog. This expands to show every specific permission the extension requests - storage, tabs, webRequest, and so on. Compare this list against the extension's described purpose. A grammar checker needs to read text fields, so clipboard or host permission makes sense. A screenshot tool needs tab access. A simple new tab page replacement should not need access to your browsing data across all sites.
After installation, you can review permissions at any time at chrome://extensions. Click "Details" on any extension and scroll to the "Permissions" section. This is also where you can grant or revoke optional permissions - permissions that the extension can request after installation rather than at install time - giving you finer control over what the extension can do.
Developer Trust Signals
A trustworthy developer is your second line of defence after permissions. Before installing, check the developer's name on the extension listing and do a quick search. Established developers have a web presence - a company website, a GitHub profile, or publication history. They maintain multiple extensions and respond to user reviews and support queries.
Look for a verified publisher badge on the Chrome Web Store listing. Google verifies publishers by confirming their identity through email domains and documentation, similar to how Apple verifies iOS developers. A verified badge means Google has confirmed the developer's identity - it does not guarantee the extension is safe, but it provides accountability. Malicious developers who are caught can be traced back to a real entity.
Check whether the developer has a published website linked in their Chrome Web Store profile. A legitimate developer invests in a website that describes their products, provides support channels, and publishes a privacy policy. Extensions from developers who list no website or use a generic placeholder like "example.com" should be treated with significant caution.
What a Good Privacy Policy Looks Like
Every Chrome Web Store extension is supposed to link to a privacy policy. In practice, many link to generic, one-size-fits-all documents or omit the link entirely. A good privacy policy is specific to the extension. It describes what data is collected (if any), how it is stored, whether it is shared with third parties, and how users can request deletion.
For extensions that store data locally - like FocusGuard, which keeps everything in Chrome's local storage - the privacy policy should clearly state that no data is transmitted to external servers. For extensions that use cloud services, the policy should specify what data is sent to which servers, how it is encrypted in transit and at rest, and how long it is retained.
Red flags in privacy policies include vague language ("we may collect information to improve our services"), blanket data collection ("we may share data with partners"), and policies that are clearly copied from another product (look for mentions of other app names or services the extension doesn't provide). A policy that hasn't been updated since the EU's General Data Protection Regulation took effect in 2018 is also a warning sign of an unmaintained extension.
Analysing Ratings and Reviews
An extension's star rating is useful as a quick signal but insufficient on its own. Extensions with 4.5+ stars and tens of thousands of ratings are generally reliable, but ratings can be artificially inflated. Look beyond the aggregate score and read the actual reviews - especially the critical ones. Users who leave negative reviews often provide specific details about problems: excessive permissions, changed behaviour after an update, performance degradation, or suspicious network requests.
Sort reviews by "Most Recent" to see whether recent users are having problems. An extension that was excellent three years ago may have been sold, abandoned, or updated with unwanted behaviour. A pattern of recent one-star reviews mentioning "ads," "tracking," "changed behaviour," or "sold to another company" is a strong warning sign.
Pay attention to how the developer responds to reviews - especially negative ones. Developers who engage constructively, acknowledge problems, and provide timelines for fixes demonstrate accountability. Developers who are dismissive or hostile in their responses should raise concerns about their long-term commitment to the extension's quality and security.
Red Flags That Should Stop You Installing
Some warning signs are serious enough that you should not install the extension until they are resolved. An extension that requests permissions clearly unrelated to its function - for example, a wallpaper extension that requests access to all website data - should be avoided entirely. An extension with no privacy policy, or a privacy policy that is obviously copied or unrelated, is another dealbreaker.
Extensions that have not been updated in over two years may work but are increasingly risky. Chrome evolves continually, and unmaintained extensions can develop security vulnerabilities or behave unexpectedly after Chrome updates. Similarly, extensions from developers with no web presence, no support channels, and no other published extensions offer no accountability if something goes wrong.
Watch for extensions that inject ads into pages, change your default search engine without asking, or display pop-ups asking for personal information. These behaviours violate Chrome Web Store policies, but extensions sometimes implement them through delayed-update techniques - passing initial review and then adding the violating behaviour in a subsequent update. If you notice an extension behaving suspiciously, disable it immediately and check recent reviews to see if other users have reported the same issue.
The Open Source Advantage
Open source extensions offer a significant safety advantage: anyone can read the code. Extensions that publish their source code on GitHub or another public repository allow security researchers, independent auditors, and technically savvy users to verify that the extension does what it claims and nothing more. If you have the technical skills, you can also review the code yourself before installing.
FocusGuard is designed with open source principles even though the extension is distributed through the Chrome Web Store. Its architecture is transparent: a service worker, a popup, and content scripts, all using standard web APIs with no obfuscation or minification that would hide behaviour. The extension makes zero network requests after installation - no analytics pings, no telemetry, no update checks beyond Chrome's built-in extension update mechanism.
Not all open source extensions are automatically safe - code can still contain vulnerabilities - but open source eliminates the possibility of hidden behaviour that the developer doesn't want you to see. Combined with a healthy community of users and contributors, open source extensions provide the highest level of transparency available.
Ongoing Extension Hygiene
Extension safety is not a one-time check. Developers can push updates that add new permissions or change behaviour, and extensions you installed safely a year ago may now behave differently. Periodically audit your installed extensions at chrome://extensions. Review each extension's permissions and ask whether it still needs them. Uninstall any extension you haven't used in the past month.
Chrome now notifies users when an extension's permissions change after an update - you must approve the new permissions before the extension can use them. Pay attention to these notifications. If an extension you've used for years suddenly requests access to your location, clipboard, or camera, investigate before accepting.
Consider using Chrome's "Review your extensions" feature, which periodically surfaces a prompt asking you to review and clean up your installed extensions. This native Chrome feature (accessible via the puzzle-piece icon) makes it easy to remove extensions you no longer need and review the permissions of those you keep.
Examples of Safe, Well-Audited Extensions
While no endorsement guarantees safety for all time, certain extensions have long track records of transparent behaviour and strong community trust. uBlock Origin is widely regarded as the gold standard for ad blocking - it's open source, lightweight, and has been independently audited by multiple security researchers. Bitwarden is an open source password manager with published security audits and clear documentation of its encryption model.
FocusGuard fits the same profile for the website blocking category: it's transparent about its architecture, stores all data locally, requests only the permissions it needs for its stated function, and publishes a clear privacy policy. The extension is free with no paid tier, removing the incentive to monetise user data that exists for freemium products. These characteristics - open source or transparent design, minimal permissions, local-first data storage, and a sustainable business model - are the strongest indicators of a safe, trustworthy extension.