To check your browser extensions for malware, open your browser's extensions page (chrome://extensions in Chrome, edge://extensions in Edge, about:addons in Firefox, or Safari > Settings > Extensions on a Mac). Remove anything you don't recognise or no longer use. For each extension you keep, open Details and check its permissions, its site access and where it came from. Watch for extensions marked "Installed by your administrator" on a personal computer, or ones that come back after you remove them. Those usually mean other software on the PC is installing them, so run a malware scan next.
Browser extensions are brilliant. I use a password manager, an ad blocker and a couple of developer tools every day. But an extension sits right inside your browser, and depending on its permissions it can see every page you visit, including your email and online banking.
Most extensions are honest. The trouble is that a good extension can turn bad overnight, for example when it's sold to a new owner who pushes out an update. You won't get a big warning when that happens.
So once in a while, I go through my extensions properly. It takes about ten minutes per browser. In this guide I'll show you exactly how to do the same in Chrome, Edge, Firefox and Safari, what the scary-sounding permissions really mean, and what to do if an extension refuses to leave.
In this guide:
- Why browser extensions are worth checking
- Warning signs of a dodgy extension
- How to check extensions in Google Chrome
- How to check extensions in Microsoft Edge
- How to check add-ons in Firefox
- How to check Safari extensions on Mac, iPhone and iPad
- What extension permissions actually mean
- If an extension keeps coming back or says "installed by your administrator"
- What to do after removing a suspicious extension
- Simple habits that keep your browser clean
- Frequently asked questions
Why browser extensions are worth checking
An extension is a small program that runs inside your browser. To do its job, it often needs permission to read and change the pages you visit. A grammar checker needs to see what you type. A coupon finder needs to read shopping pages. That access is exactly what makes a malicious extension dangerous.
A bad extension can:
- Read what you type into forms, including passwords and card numbers.
- Inject adverts or swap affiliate links into the pages you visit.
- Redirect your searches through a different search engine.
- Collect your browsing history and send it to someone else.
- Steal session cookies, which can let someone into your accounts without your password.
Browser makers do review extensions, and Google explains its automated and human checks in its post on staying safe with Chrome extensions. But no review process catches everything, and an extension that was safe when you installed it can change with a later update. That's why a regular check is worth your time.
Warning signs of a dodgy extension
Before going browser by browser, here's what I look for. One sign on its own isn't proof of malware, but two or three together means the extension should go.
| Warning sign | Why it matters |
|---|---|
| You don't remember installing it | It may have been bundled with free software or added by malware |
| It's marked "Installed by your administrator" on a personal PC | Something has set a policy to force it in |
| It's not from the official store | It skipped the store's review process |
| It wants access to all sites but its job is simple | A calculator or colour picker doesn't need to read your banking pages |
| Your search engine or new tab page changed on its own | Classic sign of a search hijacker |
| Extra adverts or pop-ups on sites that never had them | Ad injection |
| Recent reviews complain about new behaviour | It may have been sold or compromised |
| Chrome flags it in Safety Check or disables it | The store has spotted a problem or removed it |
How to check extensions in Google Chrome
Chrome has the most built-in help, so it's a good place to start.
- Type
chrome://extensionsinto the address bar and press Enter. You can also select the puzzle-piece icon and choose Manage extensions. - Look at the top of the page. If Chrome thinks any extension is risky, a Safety Check panel appears there listing it. Select Remove for anything flagged as malware or a policy violation.
- Go down the list and remove anything you don't recognise or haven't used in months. When in doubt, switch it off first with the toggle and see if you miss it.
- For each extension you keep, select Details. Check the Permissions list, the Site access setting and the Source, which tells you whether it came from the Chrome Web Store.
- Change Site access from On all sites to On click or On specific sites wherever that still lets the extension do its job.
- Turn on Developer mode (top right) if you want to see each extension's ID. That 32-letter code lets you check an extension against published lists of known malicious IDs, even if it's been renamed.
Google's help page on how to install and manage extensions also notes that some Windows and Mac programs install Chrome extensions alongside themselves. When Chrome asks whether to enable one of those, choose Remove unless you're sure you want it.
One more quick check: type "safety check" in the address bar and run Chrome's Safety Check. It reviews extensions alongside passwords and updates.
How to check extensions in Microsoft Edge
Edge is built on the same engine as Chrome, so the steps feel very familiar.
- Type
edge://extensionsinto the address bar, or select the puzzle-piece icon and choose Manage extensions. - Review the list. Use the toggle to turn off anything you're unsure about, or select Remove to delete it.
- Select Details on each extension you keep to see its permissions and site access, and limit site access where you can.
- Check whether any extensions came from the Chrome Web Store rather than Edge Add-ons. That's allowed, but it means two stores to keep an eye on.
Microsoft's guide to add, turn off or remove extensions in Edge also shows how to report an extension that contains malware via the Edge Add-ons website. If you find something nasty, reporting it helps protect other people too.
How to check add-ons in Firefox
Firefox calls them add-ons, and it gives you a clear view of each one's permissions.
- Type
about:addonsinto the address bar, or open the menu and choose Add-ons and themes, then Extensions. - Turn off or remove anything you don't recognise. To remove one, select the three-dot menu next to it and choose Remove.
- Select each remaining extension and open its Permissions tab. Here you can see what it's allowed to do, and switch off optional permissions it doesn't need.
- On the same page, check Run in Private Windows. Only allow it for extensions you really trust, such as your password manager.
- Type
about:policiesinto the address bar. On a personal computer this page should normally say there are no active policies. If you see extension policies you didn't set, something has configured Firefox behind your back.
Mozilla's support article on how to disable or remove add-ons covers the same steps and what to do if the Remove button is missing.
Firefox also tells you when an update wants new permissions. Read that prompt properly rather than clicking through. A sudden request for access to all your data on all websites, from an extension that never needed it before, is a red flag.
How to check Safari extensions on Mac, iPhone and iPad
Safari extensions come from the App Store, usually bundled inside an app. That means fewer surprises, but it's still worth a look.
On a Mac:
- Open Safari and choose Safari > Settings (or Preferences).
- Click Extensions and review the list on the left.
- Untick any extension to turn it off, or select it and click Uninstall.
- For extensions you keep, click Edit Websites and set access to Ask or Deny for sites where it isn't needed.
On iPhone or iPad: go to Settings > Apps > Safari > Extensions. Turn off anything you don't use, and delete the app that came with it if you want it gone completely.
Apple's guide to using Safari extensions on your Mac points out that if an extension is part of an app, you should delete the app too. It also notes that in recent macOS versions, extensions that need website access are off by default in private windows.
What extension permissions actually mean
Permission warnings can sound alarming, and some of them are. Here's how the common Chrome and Edge warnings translate into plain English, and when they're reasonable.
| Permission warning | What it means | Reasonable for |
|---|---|---|
| Read and change all your data on all websites | Can see and edit every page, including what you type | Password managers, ad blockers, accessibility tools |
| Read and change your browsing history | Can see everywhere you've been | History managers, some tab tools |
| Manage your downloads | Can start, open or change downloads | Download managers |
| Read and modify data you copy and paste | Can see your clipboard, which may hold passwords | Clipboard tools and some password managers |
| Manage your apps, extensions and themes | Can turn other extensions on or off | Very few. Be suspicious |
| Communicate with cooperating native applications | Can talk to a program installed on your computer | Password managers, security software |
| Change your privacy-related settings | Can alter browser privacy options | Privacy tools you deliberately installed |
The question to ask every time is simple: does this permission match the job the extension does? Mozilla's developer guide to requesting the right permissions is written for extension authors, but it's a useful look at why honest developers keep permissions to a minimum and request extra access only when needed.
If an extension keeps coming back or says "installed by your administrator"
If you remove an extension and it reappears after a restart, or the Remove button is greyed out, something outside the browser is forcing it in. On a work or school computer that's normal, because your IT team manages the browser. On your own personal PC, it usually means adware or malware has set a browser policy.
-
Check whether the browser is managed. In Chrome, open the menu and look at the bottom for "Managed by your organisation", or visit
chrome://management. In Edge, visitedge://management. In Firefox, visitabout:policies. -
Look at the policies. In Chrome or Edge, visit
chrome://policyoredge://policy. An entry such as ExtensionInstallForcelist that you didn't set is the culprit. - Check which account you're signed in with. A work or school account can legitimately manage the browser profile.
- Uninstall unknown programs from Settings > Apps on Windows or the Applications folder on a Mac, especially anything installed around the time the extension appeared.
- Run a full malware scan with Microsoft Defender or your security software.
- Reset the browser. In Chrome, go to Settings > Reset settings > Restore settings to their original defaults. Then restart the browser and the computer.
Google's page on how to check if your Chrome browser is managed follows the same order. Only edit policy entries in the Windows Registry if you're comfortable doing so and have a backup, because removing the program that sets them is the cleaner fix.
What to do after removing a suspicious extension
Removing the extension stops it doing anything new. But if it was malicious, it may already have collected data, so it's worth a quick clean-up:
- Sign out of all sessions on your important accounts (email, banking, social media). Most have a "sign out of all devices" option in their security settings. This kills any stolen session cookies.
- Change passwords for accounts you used while the extension was installed, starting with email and banking.
- Check two-factor authentication is on for those accounts, so a stolen password alone isn't enough.
- Check your browser settings: default search engine, home page, new tab page and site notification permissions.
- Watch your bank statements for a few weeks.
If you're worried your details have already leaked, my guide on how to check if your email was breached shows how to find out and what to change first.
Simple habits that keep your browser clean
Once your list is tidy, a few habits will keep it that way:
- Install fewer extensions. Each one is more code with access to your browsing. If a website or built-in browser feature does the job, skip the extension.
- Only use official stores. Chrome Web Store, Edge Add-ons, Firefox Add-ons and the App Store all review submissions. Avoid installing extensions from random websites.
- Check the listing first. Look at the developer name, the number of users, recent reviews, the last updated date and the privacy section.
- Prefer "on click" access. If an extension only needs to work when you press its button, set it that way.
- Keep your browser updated. Updates bring security fixes and better extension checks.
- Repeat this check every few months, and whenever your browser starts behaving strangely.
Extensions also make your browser more unique, which can help websites recognise you across visits. If that interests you, my explainer on browser fingerprinting covers how it works and what you can do about it.
Frequently asked questions
Can a browser extension steal my passwords?
Yes, if it has permission to read and change data on the sites you visit. It can read what you type into login forms or capture session cookies. That's why you should only keep extensions you trust and limit their site access.
How do I know if a Chrome extension is safe?
Check that it comes from the Chrome Web Store, has a known developer, recent positive reviews, a recent update date and a clear privacy section. Its permissions should match its job, and Chrome's Safety Check should not flag it.
Does antivirus detect malicious browser extensions?
Some security software scans browser extensions, and a malware scan can find programs that force extensions into your browser. It won't catch everything, so reviewing your extensions yourself is still worth doing.
Why can't I remove a Chrome extension?
If the Remove button is missing or the extension says it's installed by your administrator, a policy is forcing it. On a work device that's normal. On a personal PC, check chrome://policy, uninstall unknown programs, run a malware scan and reset Chrome.
Are Firefox add-ons safer than Chrome extensions?
Neither is automatically safer. Both stores review extensions, and both have had malicious ones slip through. What matters most is installing few extensions, checking their permissions and removing ones you don't use.
Is incognito or private mode safe from extensions?
Mostly. Chrome and Edge don't run extensions in incognito unless you allow them, and Firefox and Safari also ask before running extensions in private windows. Only allow extensions you fully trust to run there.
How often should I check my browser extensions?
Every few months is a good routine, plus any time your browser starts acting oddly, such as a changed search engine, extra adverts or unexpected pop-ups. It only takes about ten minutes per browser.
Last checked: 27 October 2026. Figures, settings and guidance can change, so confirm anything important with the sources linked above.
Originally published on mfaysal.com.
I'm learning cybersecurity on TryHackMe — follow my progress at tryhackme.com/p/mfaysal.dev.
Top comments (0)