When you install a browser extension, you're giving it significant access to your browser. Extensions can read the content of pages you visit, intercept requests, modify what you see, and in some cases access your passwords or financial information. The question of which extensions to trust matters.
One marker of trustworthiness that's underused: open source code.
What Open Source Actually Means for Extensions
An open source extension has its code publicly available for anyone to inspect. You can read exactly what the extension does, verify that it matches the description, and confirm there's no hidden behavior.
This is meaningfully different from closed source extensions, where you're taking the developer's word that the extension only does what they say it does.
For security-conscious users, the difference is significant. For typical users, the signal "this extension is open source" is a reasonable proxy for "the developer has nothing to hide."
The Reality of Extension Trust
Most users don't read source code. So why does open source matter for them?
Because security researchers, developers, and journalists do read it. If a popular open source extension had hidden tracking or malicious behavior, it would likely be caught and publicized. This creates accountability that closed source extensions don't have.
AMO (addons.mozilla.org) also does code review before listing extensions, but their review process is less comprehensive for closed source submissions.
Examples of Trustworthy Open Source Extensions
uBlock Origin — The most widely used ad and tracker blocker. The code has been reviewed by security researchers for years. Raymond Hill (gorhill) maintains it publicly on GitHub. When Mozilla announced changes to extension APIs, the conversation about uBlock's future happened in public.
Firefox Multi-Account Containers — Developed by Mozilla directly. Source code is public, issues are tracked publicly, the security model is documented.
Weather & Clock Dashboard — My new tab extension. The source is available on GitHub (MIT license). You can verify that it uses your device's location API for local weather, that it doesn't collect or transmit browsing history, and that there's no analytics or tracking code.
How to Find the Source Code
For extensions listed on AMO, check the extension detail page. Many extensions link to their GitHub or GitLab repository in the listing. You can also search for the extension name on GitHub directly.
For Firefox specifically, AMO requires extension developers to provide source code during the review process, even if it's not publicly available to users. This gives Mozilla the ability to audit code even when it's not publicly listed.
Red Flags for Extensions
- Extension requests more permissions than it needs (a weather extension that asks for access to all website data)
- No source code available and developer is anonymous
- Recently created with no developer history
- Unusually large file size for simple functionality
- Requests to disable other security extensions
Minimal Permission Review
When you install any extension, Firefox shows you what permissions it requests. Take 30 seconds to read them:
- Access your data for all websites: The highest-access permission. Needed for tools like uBlock Origin that work on every page, but should be justified.
- Access your data for [specific site]: More targeted. Appropriate for site-specific tools.
- Store unlimited data: Extension can save significant data locally.
- Exchange messages with programs other than Firefox: Extension can communicate with installed programs — unusual and worth scrutinizing.
A trustworthy extension only requests what it needs. If a simple task manager requests access to all websites, that's a mismatch worth questioning.
The Bottom Line
You can't review every extension's source code. But you can:
- Prefer extensions with public source code
- Check permissions against expected functionality
- Use extensions with long track records and clear developer identity
- Install fewer extensions overall (each one is a trust decision)
The open source community has built some excellent Firefox extensions. Using them preferentially over closed alternatives is a simple, low-effort way to make your browser more trustworthy.
Top comments (0)