Browser Extensions and Site Permissions

Build the mental model

Browser extensions are small programs that run inside your browser, and what they can actually access depends entirely on the permissions they were granted when you installed them. A simple ad blocker and a full password manager might both request access to "all data on all websites," and for the password manager that's genuinely necessary to fill in login forms anywhere, while for a narrower tool it may be far more than the job requires.

Not every extension is equally risky; the risk tracks the gap between what an extension does and what it's allowed to access, not the mere fact that it's an extension at all.

Depending on its permissions, an extension can potentially read the pages you visit, see your browsing history, access what's on your clipboard, read and modify open tabs, or see what you type into forms. That's a meaningful amount of access to hand out casually, which is why the practical habit is to install only extensions you'll actually use, glance at what permissions each one requests before installing, and periodically remove ones that have quietly stopped being useful.

Site permissions work on a similar logic but at the website level rather than the extension level: camera, microphone, location, notifications, clipboard, and file access are all gated behind a prompt a specific site has to request and you have to approve. Reviewing what's been granted over time, and revoking access that no longer makes sense, matters here too.

A site asking for a permission unrelated to what it obviously does, like a text-editing tool requesting your location, is itself worth noticing as a signal, independent of whether it turns out to be justified.

EXTENSION AND SITE PERMISSION SCOPE
-----------------------------------
BROWSER
  |
  +-- Extension: Ad Blocker       [reads all page data]
  +-- Extension: Screenshot Tool  [runs only on click]
  +-- Extension: Old Weather App  [reads all page data, UNUSED]

  SITE PERMISSIONS PANEL
  camera .......... denied
  microphone ....... denied
  location ......... granted
  notifications ..... granted

  Review permissions periodically; revoke what is not needed.

Connect it to a real scenario

Open your browser's extensions page occasionally and actually read the list; it's common to accumulate extensions installed for a one-time task months ago and never removed. For each one still there, ask whether you genuinely use it, and if the honest answer is no, remove it rather than leaving it installed "just in case."

Before installing something new, look at the permission it requests during setup. A permission that matches the extension's obvious job, like a screenshot tool needing to read the current page, is normal. A mismatch, like a simple calculator wanting access to all your browsing data, is worth pausing on even if the extension turns out to be legitimate.

For site permissions, most browsers have a settings page listing every site you've granted camera, microphone, location, or notification access to, often grouped by permission type. Walk through it every so often and revoke anything you don't recognize or no longer need; a site you tried once for a video call a year ago rarely needs standing camera access today.

• An extension's real risk comes from the gap between what it needs and what it's permitted to access, not its category.
• Install only extensions you'll actually use, check permissions before installing, and remove unused ones periodically.
• Site permissions like camera, microphone, and location deserve the same periodic review as extensions.

Extension and Permission Review

• Only actively-used extensions are installed
• Extension permissions were reviewed before installing
• Unused extensions have been removed
• Site permissions are reviewed periodically
• Camera and microphone access is granted only where genuinely needed

Try the working example

function flagExtensionsForReview(extensions, referenceDate, unusedDaysThreshold = 90) {
  const broadScopes = new Set(["reads all page data", "reads all page data and browsing history"]);
  return extensions.map((ext) => {
    const daysSinceUse = Math.floor((referenceDate - new Date(ext.lastUsed)) / 86400000);
    const reasons = [];
    if (daysSinceUse >= unusedDaysThreshold) {
      reasons.push(`unused for ${daysSinceUse} days`);
    }
    if (broadScopes.has(ext.permissionScope) && ext.needsBroadAccess === false) {
      reasons.push(`permission "${ext.permissionScope}" looks broader than a "${ext.purpose}" tool needs`);
    }
    return { name: ext.name, flagged: reasons.length > 0, reasons };
  });
}

const referenceDate = new Date("2026-08-24");
const extensions = [
  { name: "Cloud Password Manager", purpose: "password autofill", permissionScope: "reads all page data", needsBroadAccess: true, lastUsed: "2026-08-20" },
  { name: "Retro Screenshot Tool", purpose: "screenshot capture", permissionScope: "runs only on click", needsBroadAccess: false, lastUsed: "2025-10-01" },
  { name: "Unit Converter", purpose: "unit conversion", permissionScope: "reads all page data", needsBroadAccess: false, lastUsed: "2026-08-15" },
];

console.log(flagExtensionsForReview(extensions, referenceDate));

The Cloud Password Manager isn't flagged, since its broad permission matches its stated need. The Retro Screenshot Tool is flagged as unused for 327 days. The Unit Converter is flagged because its 'reads all page data' permission looks broader than a unit-conversion tool needs, even though it's used regularly.

MDN – WebExtensions permissions — Digital Privacy & Modern Security