You probably have between five and twenty Chrome extensions installed right now. Ad blockers, password managers, productivity tools, AI assistants. Each one has access to some portion of your browsing activity, and many have far more access than you realize. Understanding how extensions work, and what can go wrong, is one of the most practical security steps you can take.
How Extensions Actually Work
Chrome extensions operate through a permissions model defined in a file called manifest.json. When you install an extension, it declares what it needs access to, and Chrome enforces those boundaries. At least, that is the theory.
The Permissions Model
Extensions request permissions at install time. Some are narrow, like access to a single website. Others are broad, like "Read and change all your data on all websites." That second category is where the risk concentrates. An extension with activeTab permission can only access the current tab when you click the extension icon. An extension with <all_urls> permission can read every page you visit, all the time.
Content Scripts
Content scripts are JavaScript files that run inside web pages. They can read the DOM, modify page content, and intercept form submissions. If an extension injects a content script into your banking site, that script can see everything you see, including account numbers, balances, and session tokens.
Background Workers
In Manifest V3, background service workers handle the extension's core logic. They can make network requests, manage storage, and communicate with content scripts. A malicious background worker can silently exfiltrate data to a remote server without any visible indication in the browser.
The Real-World Risks
The permission model creates a trust relationship between users and extension developers. When that trust is violated, the consequences can be severe.
Data Harvesting
Some extensions collect browsing history, search queries, and form data, then sell that information to data brokers. This often happens through extensions that provide a legitimate service while quietly logging everything in the background. The extension works as advertised, so you never suspect a problem.
Session Hijacking
Extensions with broad permissions can access authentication cookies and session tokens. An attacker who compromises an extension, or who builds a malicious one from scratch, can steal active sessions for email, banking, cloud services, and corporate applications. No password needed.
AI Chat Interception
As AI assistants become central to daily work, extensions that can read page content can also read your conversations with ChatGPT, Claude, Gemini, and other AI tools. People routinely paste proprietary code, business strategies, and personal information into these chats. A content script on those pages captures all of it.
Notable Attack Patterns
Security researchers have documented several recurring patterns in malicious extension campaigns:
- Legitimate-to-malicious pipeline: A developer builds a popular, genuinely useful extension, then sells it to a buyer who pushes a malicious update to the existing user base. Users never re-approve permissions because the permissions have not changed.
- Copycat extensions: Attackers clone popular extensions with slightly different names and icons. Users searching the Chrome Web Store install the fake version, which bundles spyware alongside the expected functionality.
- Supply chain compromise: Attackers target the developer's account through phishing or credential stuffing, then push malicious updates through the legitimate extension's distribution channel.
- Permission creep through updates: An extension launches with minimal permissions, builds a user base, then requests broader permissions in an update. Many users click "approve" without reading the new permission list.
How to Audit Your Extensions
Taking control of your extension security does not require technical expertise. Here is a practical process you can follow today:
- Open your extension list. Navigate to
chrome://extensionsin your browser. Review every extension installed. If you do not recognize one, remove it immediately. - Check permissions. Click "Details" on each extension and review its permissions. Be skeptical of any extension requesting access to "all sites" or "all your data."
- Review the developer. Click through to the Chrome Web Store listing. Check the developer's website, the number of users, and recent reviews. Look for complaints about privacy or unexpected behavior.
- Check update frequency. Extensions that have not been updated in over a year may be abandoned. Abandoned extensions are acquisition targets for malicious actors.
- Remove what you do not use. Every extension is an attack surface. If you installed something six months ago and forgot about it, remove it. You can always reinstall it later.
- Monitor for permission changes. When an extension update requests new permissions, Chrome will disable it until you approve. Read those permission requests carefully before approving.
Tools That Help
Manual auditing is a good start, but a long extension list is difficult to review consistently. A capability scanner can make that first pass faster by organizing declared permissions and host access into an explainable queue.
Runtime browser-security products can go further by inspecting extension code, network destinations, and behavior over time. That is a different class of control from a local permission audit, and the distinction matters.
We built AI Chat Shield for the narrower local review. It reads installed-extension metadata, declared permissions, host access, and install-source signals, then shows which extensions deserve closer scrutiny around AI chat sites. It does not inspect another extension's private code, DOM activity, or live network traffic, and it does not block exfiltration automatically.
"The most dangerous extensions are the ones that work perfectly. You never question something that does exactly what it promised."
Browser extensions are powerful tools, but that power cuts both ways. Take fifteen minutes today to audit your installed extensions. Remove anything unnecessary, scrutinize permissions on what remains, and use managed-browser or runtime controls when the sensitivity of the work requires them.
2025-2026: The AI Chat Harvesting Wave
The theoretical risks outlined above stopped being theoretical in late 2025. A wave of incidents confirmed that AI chat data has become a primary target for malicious extensions. Here is what happened, and what the security community learned from each case.
December 2025: The Trusted VPN Extension
In December 2025, researchers at Koi Security discovered that a popular VPN extension with over 8 million users had been silently harvesting conversations from eight major AI platforms, including ChatGPT, Claude, Gemini, and five others. The extension carried Google's "Featured" badge, which most users interpret as a seal of safety. Malwarebytes independently confirmed the findings and reported that the harvested data was being sold to third-party data brokers. The extension had been operating with broad host permissions for months before anyone noticed, because it performed its VPN function perfectly well. Users had no reason to suspect a problem.
January 2026: Fake AI Productivity Tools
Two extensions marketed as AI productivity assistants accumulated over 900,000 installs combined before being pulled from the Chrome Web Store. SOCRadar and Dataprise both published analyses showing that these extensions stole complete chat histories from ChatGPT and DeepSeek, along with authentication tokens that could be used to access user accounts directly. The extensions used content scripts to scrape conversation text from the DOM, then exfiltrated the data through encoded POST requests disguised as analytics calls. By stealing auth tokens alongside chat content, the attackers could also access stored conversations that happened before the extension was even installed.
March 2026: Microsoft's Research on Passive Collection
In March 2026, Microsoft's Security Blog published research documenting a category of malicious extensions designed specifically for passive AI chat collection. Unlike the earlier incidents, which relied on active data exfiltration, these extensions used a subtler approach. They quietly recorded chat content into local storage, then uploaded it in small batches during normal browsing activity to avoid triggering network anomaly detections. Microsoft's research highlighted that the passive collection model makes these extensions significantly harder to detect through traditional network monitoring alone.
How Capability Scoring Helps Prioritize Review
Each incident above involved powerful access that could have justified closer review before the malicious behavior was confirmed. AI Chat Shield combines five declared-capability signals into a transparent exposure score. The score is a triage aid, not a malware verdict.
1. Permission Scope
Extensions requesting <all_urls> or broad host access score higher than those with narrow, task-specific access. Broad access is not automatically malicious, but it increases the impact of a bad update or compromised publisher.
2. AI-Site Host Access
The scanner distinguishes host permissions that explicitly name supported AI domains from broad wildcards that merely include them. Direct access is a stronger review signal, especially when the extension's stated purpose has nothing to do with AI tools.
3. Request and External Access
Permissions such as webRequest, declarativeNetRequest, proxy control, and native messaging can influence requests or bridge to software outside the browser. AI Chat Shield scores the declared capability; it does not observe request destinations or payloads.
4. Sensitive Browser Access
History, cookies, downloads, clipboard, identity, debugger, extension-management, and script-execution permissions are grouped into readable access categories. Multiple high-impact categories increase the review priority.
5. Install Source
Chrome reports whether an extension was installed normally, by an administrator, in development mode, or through a sideload path. The source is context rather than proof, but development and sideloaded installs deserve additional verification.
What the Score Cannot Tell You
The browser management API does not expose another extension's private source code, live DOM activity, network destinations, or post-update behavior. Those questions require source analysis, managed-browser telemetry, endpoint controls, or dedicated runtime monitoring.
Putting It Together: The VPN Extension Example
The December 2025 VPN extension requested broad access that covered AI sites and used powerful request capabilities. Those declarations would raise its review priority, even though a permission-only scan could not prove the later collection and exfiltration behavior. That is the useful boundary: capability scoring can tell you where to look, while research or runtime evidence determines what actually happened.
AI Chat Shield is built for that first decision: which extensions deserve a closer look before sensitive AI work continues.