I build Extension Guardian, a free extension that warns you when one of your extensions changes owner or asks for new permissions. I wanted a baseline: what do the extensions most people actually have installed ask for? So I pulled the 150 most-used extensions from the Chrome Web Store and read their manifests.
Full report with every extension: https://app.extensionguardian.workers.dev/report/popular-chrome-extensions-2026
The numbers
- 64% (94 of 148) can read and change everything on every website you visit.
- Together that's about 812 million installs with all-sites access.
- 24 haven't been updated in over a year, 15 of them in over two.
- 48 of the all-sites extensions come from developers who haven't registered as a business in the store.
- 0 are still on Manifest V2. The migration is done, at least at the top.
The most common powerful permissions:
| Permission | What it allows | Extensions |
|---|---|---|
scripting |
Run its own code on pages | 93 |
tabs |
See the address and title of every tab | 76 |
webRequest |
Watch your network requests | 46 |
cookies |
Read and change cookies, including sign-ins | 40 |
nativeMessaging |
Talk to programs installed on your computer | 11 |
Full access isn't the problem
My first reaction was "64% is terrible". It isn't, really. An ad blocker, a password manager or a grammar checker can't work without reading the pages you open. Our own risk model rates all 148 as low risk today: they're popular, maintained and have a named developer.
The problem is that this access is transferable. When an extension is sold, the buyer gets the users, the reviews and every permission, and Chrome installs the next update silently. Nothing tells you the developer changed. This year attackers bought established extensions and turned them into credential and wallet stealers.
That's why the list I find most interesting is the 12 extensions with all-sites access that haven't shipped an update in over a year, about 20 million installs combined. Some are simply finished software. But a popular extension whose developer has moved on is exactly what buyers look for.
How I got the data
- The list: the extensions with the most users across the Web Store's categories.
- Store data (developer, users, last update, trader status) from each public listing.
- Permissions from the CRX of the current version. A CRX is a zip with a header, so I used HTTP range requests to read only the zip's central directory and
manifest.json, instead of downloading 150 packages. - Access and risk ratings from the same open-source code the extension uses: https://github.com/laboskiriste/extension-guardian
Optional permissions aren't counted, and user counts are the store's rounded install numbers, so totals overlap.
The raw data is free to reuse: https://app.extensionguardian.workers.dev/report/popular-chrome-extensions-2026.json
If you want to check an extension you use, paste its store link here: https://app.extensionguardian.workers.dev/
Top comments (0)