Browser extensions are software that run on every page you visit. They can read your browsing history, inject scripts, intercept requests, and in extreme cases, exfiltrate data silently. This is not hypothetical — there have been multiple high-profile cases of extensions sold to malicious actors after acquiring user bases, then updated to include data-stealing code.
The most practical protection is choosing extensions that are open source.
What Open Source Actually Gives You
For extensions specifically, open source means:
- Code is inspectable: You (or someone you trust) can verify what the extension actually does versus what it claims to do.
- No silent updates with malicious code: Changes are visible in version history on GitHub.
- Community review: Popular open source extensions get scrutinized by developers.
- No acquisition risk: Even if the developer sells the project, the existing code is auditable.
This doesn't mean all closed-source extensions are malicious, or that all open-source ones are safe. But it raises the default trust floor substantially.
Mozilla's "Recommended" Badge
Firefox's AMO has a Recommended badge for extensions that Mozilla has manually reviewed. This is a real review — not just automated checks. It's a useful signal for closed-source extensions, but it doesn't replace open source.
For open-source extensions, check both: Is it Recommended AND open source? That's the highest confidence level.
Extensions Worth Knowing About (All Open Source)
uBlock Origin — GitHub: gorhill/uBlock
The standard for ad/content blocking. MIT licensed. Scrutinized by thousands of developers. The source code matches what it claims to do. No reason to use any other content blocker.
Firefox Multi-Account Containers — GitHub: mozilla/multi-account-containers
By Mozilla itself. Isolates cookies/sessions per container. Essential for anyone who manages multiple accounts on the same services.
Facebook Container — GitHub: mozilla/contain-facebook
Isolates Meta tracking. Also by Mozilla. Simple, auditable.
Privacy Badger — GitHub: EFForg/privacybadger
By EFF. Learns to block invisible trackers based on behavior rather than lists. Complementary to uBlock.
Weather & Clock Dashboard — GitHub: oren-sys/weather-clock-dashboard
MIT licensed new tab extension. Pure HTML/CSS/JS — no build step, no framework, nothing compiled. You can read every line of the source in 20 minutes and know exactly what it does. It requests weather from an API using your browser's location permission and displays it. That's it. AMO listing.
Bitwarden — GitHub: bitwarden/clients
Open source password manager. The extension code is auditable. The backend server code is also open source (you can self-host). Strong contrast to LastPass, which is closed source and has had significant breach incidents.
The Permission Check
Even with open-source extensions, check the permissions they request. In Firefox: about:addons → click any extension → "Permissions" tab.
An extension that requests access to "all websites" has significantly more power than one limited to specific domains. A new tab extension doesn't need access to all websites at all.
Weather & Clock Dashboard's permissions in Firefox: tabs (for replacing the new tab page) and optional location. That's it. No "read and change all your data on all websites."
What This Costs You
Switching to open-source equivalents requires no money and minimal effort:
- Replace LastPass with Bitwarden: 20 minutes including import
- Replace Grammarly with LanguageTool (open source alternative): similar quality for most users
- Replace any proprietary new tab extension with an open-source one: 2 minutes
The main cost is inertia.
Are you running any closed-source extensions you're not sure about? about:addons → check permissions → search GitHub for the extension name to find if it's open source.
Top comments (0)