Insights on browser extension development, security best practices, analytics, and the extension ecosystem.
Chrome shows no warning for the sessions permission alone. Here's what extensions can really see in your recently closed tabs — and how to check yours.
Chrome 155 added runtime.onEnabled; runtime.onExtensionLoaded follows in 157. Which event fires when, one listener pattern for both, and the edge cases.
Install counts and extension ratings disagree more often than you think. I split 16,501 rated extensions into hidden gems and coasting incumbents — the data.
Build a Chrome new tab override with chrome_url_overrides and topSites: instant-paint dashboard, local favicons, optional history strip, and a real opt-out.
Chrome proposes chrome.crossOriginStorage, a new MV3 API. Firefox 158 ships a breaking publicSuffix change, runtime.getVersion() parity, MessageSender.windowId.
The Forg365 phishing kit gives attackers an extension that keeps stolen Microsoft 365 sessions alive. What actually evicts them, and how to check your browser.
Build a chrome extension badge with chrome.action in MV3: per-tab badge text, a code-drawn icon, and state that survives worker teardown. Hands-on tutorial.
I unpacked the current builds of seven developer extensions, from Wappalyzer to React DevTools, and traced what each one reads and sends off your machine.
Global Privacy Control (GPC) is the opt-out signal a dozen US states make businesses honor. How it works, why Chrome lacks it, and what it means for extensions.
The W3C WebExtensions groups meet at TPAC 2026 in Dublin, Oct 26–30. The agenda: deferred permissions, a sidebar API, WebMCP. What to do before it.
Chrome vs Firefox vs Edge extension stores, judged by 362,889 listings in our August 2026 catalog snapshot: upkeep, MV3, users, ratings. Which earns trust?
Build an MV3 popup with the Chrome bookmarks API: flatten the whole bookmark tree, search it live as you type, and de-duplicate URLs behind a safe preview step.
Chrome 157 beta started October 14 with five extension changes merged. Chrome 156 hits early stable. Plus runtime.onEnabled and a rejected W3C proposal.
Omnistealer hides its payloads on public blockchains and hunts 60+ crypto wallet extensions. How the fake job offer works, and how to protect yours.
Dozens of hidden Chrome extensions with ~6M users ran obfuscated tracking code. What 'hidden' listings mean, how the tracking hides, and how to check yours.
Mailtrack vs Boomerang vs Streak, plus Right Inbox and Gmelius: Gmail extension privacy judged by their real Chrome manifests and policies, not marketing.
Build chrome extension keyboard shortcuts into an MV3 manifest: declare commands, handle chrome.commands.onCommand, go global, and survive the 4-key cap.
The August 2026 Chrome Web Store policy update bans AI-jailbreak extensions and tightens data rules. Here's what changed and how to check your own extensions.
Safari 27 web extensions get runtime.getDocumentId(), user-gesture propagation, a tabId for windows.create and error reporting. What landed, what to do.
Build an MV3 extension whose settings follow the user to every device — chrome.storage.sync quotas, onChanged, and the sync vs local split, with full code.
Chrome Gemini Skills now does what AI sidebar extensions charge for. I compared permissions, security records, and privacy to decide which one to trust.
Build a Chrome extension whose notification buttons still work minutes later, after the MV3 service worker died. Full runnable code and the lifecycle rules.
Chrome 154 shipped the async_listener_registration manifest key for MV3 service workers. Here's what landed, who it covers, and why you shouldn't switch yet.
Find the best YouTube summarizer extension for your workflow. Compare Glasp, Eightify, NoteGPT and Glarity on transcripts, free limits, privacy and study tools.
Build a Chrome extension context menu with selected text, saved links and a popup. Get full MV3 code, real screenshots and fixes for missing or duplicate menus.
Compare MozBar, Ahrefs, SEOquake, Keywords Everywhere and Similarweb: page access, privacy disclosures and on-click controls. Choose a toolbar with confidence.
Localize a Chrome extension with chrome.i18n, _locales and __MSG_. Follow a runnable MV3 example with plural forms, RTL layouts and fixes for missing messages.
Manifest V2 extensions have left the Chrome Web Store. Check your extension ID, find the original developer and vet a safe replacement before you install it.
Use Chrome omnibox and activeTab to highlight or count text on the current page. Follow runnable MV3 code and troubleshoot script injection without host access.
What does clipboardRead let a Chrome extension access? Compare clipboard permissions with copy-and-paste events, then check which installed tools need access.
Build a Chrome extension omnibox command palette with one keyword, live suggestions and saved shortcuts. Get full MV3 code with no install permission warnings.
Understand Claude for Chrome security risks from synthetic clicks. Learn the reported attack conditions and how to isolate your AI tools from other extensions.
Use the Chrome cookies API in Manifest V3 to read, edit and watch cookies. Fix empty getAll results, host permissions and duplicate cookies with runnable code.
Build a Chrome privacy API panel that checks levelOfControl before changing settings. Add optional permissions and browsing-data controls with full MV3 code.
A service worker can't hold a MediaStream. Build a Chrome extension that records the current tab's video and audio with chrome.tabCapture — full code, ~30 min.
The privacy permission lets an extension flip Chrome's own switches — Safe Browsing, autofill, WebRTC, cookies. Here's what it changes and how to check yours.
How long does it take to publish a Chrome extension? Review timelines, rejection reasons, and the hidden work before your listing goes live in 3 stores.
2FA browser extensions compared: where Authenticator, 2FAS and password-manager TOTP keep your seeds — and how the fake authenticator clones steal them.
A Chrome extension pulled in January is back — and shipped its payload two weeks after a clean release. How update-time malware works, and how to check yours.
CWS API V1 dies October 15. Chrome 153 adds chrome.publicSuffix. Edge MV2 and Firefox's two-week train are background.
A hands-on Manifest V3 tutorial: use the chrome.management API and Chrome's own permission warnings to audit every extension installed. Full runnable code.
Cookie extensions touch your session tokens and every site you visit. I compared Cookie-Editor, Cookie AutoDelete and the banner blockers on who owns them.
Your content script runs once on YouTube and never again. Fix Chrome extension SPA navigation with webNavigation — or without a new permission. Full MV3 code.
Edge starts phasing out MV2. Firefox 155 goes fortnightly. Chrome 153 binds protocol handlers to the extension lifetime.
Socket found 737 fake VPN extensions routing Chrome browser traffic through one operator's SOCKS5 proxies. Here's how to check yours and reset the damage.
chrome.scripting.executeScript end to end: inject on click with activeTab, pass args safely, and choose ISOLATED or MAIN world. Full MV3 code, ~25 min.
Replacing your new tab page takes no permission at all. Here's what a new tab override extension can really see, when it's fine, and how to check yours.
I compared three text-to-speech extensions on one question: does the text on your screen stay on your device, or does someone else's server read it first?
Chrome extension optional permissions, end to end: install with no warning, then request topSites and a single host at runtime. Full MV3 code, ~25 minutes.
Edgecution abused native messaging to run a Python backdoor outside Edge's sandbox — from a headless browser you'd never see. How to check your own machine.
Firefox 154 ships the sandbox manifest key. Chrome 153 blocks user scripts from privileged renderers and asks you to reload after site-access changes.
Mozilla's W3C proposal puts AI agent permissions on the browser's extension model. I counted that model at scale: 300,503 extensions, 12,277 already pulled.
OpenAI's Black Hat 2026 talk showed autonomous AI agents coordinating attacks and breaching Hugging Face — the security debt they walked through is yours too.
Build a Manifest V3 Chrome extension that blocks trackers and strips tracking parameters with declarativeNetRequest — full runnable code, ~30 minutes.
The downloads permission lets an extension read every file you've downloaded, write new ones, and hide the download UI. Here's what it allows and how to check.
I compared four PDF extensions on permissions and where your documents go. Which upload your files, which stay local, and what the Adobe Acrobat flaw exposed.
MV3 service workers have no DOM. Build a Chrome extension that parses HTML and writes to the clipboard from an offscreen document — runnable code, ~25 min.
AMO now builds Firefox add-ons from source. Chrome 152 beta brings a badge cap and a tighter browser namespace.
MV3 kills setInterval. Build a Chrome extension background job with chrome.alarms that survives service worker termination — full runnable code, ~20 min.
The debugger permission gives an extension full Chrome DevTools Protocol access — cookies, keystrokes, any page. Here's what it allows and how to check yours.
A hands-on Manifest V3 tutorial: build a Chrome extension side panel that persists across tabs, then make it per-site. Full runnable code, ~25 minutes.
Are volume booster extensions safe? I break down the permissions, the 1.5M-user sleeper spyware LayerX found, and how to spot a sound booster worth trusting.
Infostealers now bypass Chrome's App-Bound Encryption to raid crypto wallet and password manager extensions. Here's how to check yours and lock them down.
Chrome 151 deletes every remaining MV2 flag. Messaging gets structured clone. setBadgeText is capped at 100 bytes.
The webNavigation permission lets an extension watch every URL you open live — no host permissions, no injected code. Here's what it sees and how to check.
I compared four popular website blocker extensions on permissions and data sharing. Here's which focus tools keep your browsing private and which don't.
A malicious browser extension can let a remote server open any tab — an ad, a redirect, a fake login. How it works, and how to check and remove them fast.
CWS data-minimisation rules enforce August 1. Firefox 153 ships tomorrow. Firefox and Safari just lined up behind COOP/COEP for extension pages.
The GlassWorm takedown by CrowdStrike and Google won't uninstall anything. Here's how to check for malicious browser extensions still sitting in your browser.
The management permission lets a browser extension list every other extension you've installed and toggle them off. Here's what it exposes and how to check.
Screen recorder extensions can reach your camera, mic and every tab. Here's the permission breakdown, the Screencastify webcam bug, and how to record safely.
Chrome Web Store yanks remaining MV2 listings on August 31. AI-agent permissions landed at W3C. The MV2 preference storage is already deleted in Chromium.
A fake imToken Chrome extension posed as a color picker and phished seed phrases using invisible homoglyphs. Here's how to check your extensions and stay safe.
The storage permission is the most-requested thing extensions ask for — 62% claim it, with no install warning. Here's what it keeps, where, and how to check.
Is Dark Reader safe? It reads every site you visit — and so do its clones. My security review of Dark Reader, plus the dark mode copies you should avoid.
Socket found 108 Chrome extensions routing logins and live Telegram sessions to a single server. Here's how the campaign worked and how to check your own.
Chrome Web Store opens to 120+ countries, Firefox 153 ESR is two weeks out, and W3C still can't agree a cap on unlimitedStorage. Here's what actually matters.
Firefox 153 makes extension file access opt-in from July 21 — even for add-ons you already installed. We found 842 Firefox add-ons that request file:// access.
The proxy permission lets a browser extension reroute all your traffic through servers it controls. Here's what it really allows — and how to check yours.
I compared four web clipper extensions on permissions and data flow. Which read every page you visit, which stay local, and which one I'd actually trust.
Session cookie theft lets attackers skip your login and 2FA. Chrome 146's DBSC binds sessions to your device — but here's the gap extensions still exploit.
The unlimitedStorage permission lets extensions hoard data on your disk with no cap. ~687M users are exposed — and W3C is debating a limit on July 2, 2026.
The activeTab permission lets browser extensions touch the page you're on — only when you click, with no scary install warning. Here's what it grants.
I compared four popular tab manager extensions on permissions, data sync, and privacy. Here's which keep your tab list local and which ship it to the cloud.
A disabled extension can't clear its uninstall URL (setUninstallURL) before removal — the service worker is already dead. Here's why, and the server-side fix.
Two-thirds of Edge extensions and half of Firefox add-ons sit abandoned — no security update in a year. Why stale extensions are risky and how to check yours.
Chrome added a native, promise-based browser.* namespace in 148. Across the 235,887 Chrome extensions we track, here's what it changes — and what to do.
The history permission lets a browser extension read every site you visited — even before you installed it. Here's what it exposes and how to check yours.
Everyone said Chrome's Manifest V2 deadline would kill ad blockers. Here's what the sunset actually stranded — and why Firefox is now the MV2 refuge.
SponsorBlock, Return YouTube Dislike and Enhancer for YouTube checked on permissions, privacy, and how to spot risky clones.
A fake uBlock Origin clone crashed Chrome on purpose, then tricked users into running malware. Here's how to spot the CrashFix trap and check your extensions.
The webRequest permission lets browser extensions watch — and sometimes rewrite — every network request you make. Here's what it really sees and how to check.
chrome.runtime.setUninstallURL opens a page after someone uninstalls your extension. Here's how to turn that uninstall moment into structured churn feedback.
Translation extensions read the full text of every page you translate. I review Google Translate, DeepL, and Immersive Translate on permissions and data flow.
An ACM study found 15.97% of extensions start third-party tracking within 60 seconds. Here's why the permission list never told you, and how to check.
Coupon and cashback extensions watch every site you visit. I review Honey, Rakuten, and Capital One Shopping on permissions, privacy, and the affiliate mess.
I mapped browser extension permissions across 308,210 live listings: 62% claim storage, 7.4% can read every site you visit. Here's what to pause on.
GhostPoster hid malware inside extension icon images for up to five years across Chrome, Firefox, and Edge. Here's how steganography works and what to check.
A privacy researcher says Chrome ships almost no fingerprinting defenses. Here's what sites can really learn about you — and which extensions help.
Screenshot extensions can read every page they capture. Here's the permission breakdown, what the ShotBird hijack revealed, and how to grab screens safely.
Google accidentally exposed an unfixed Chromium service worker flaw that keeps background scripts running after you close the browser. Here's how to stay safe.
The NordVPN extension's new on-device AI voice detector flags deepfake audio without sending anything anywhere. Review of permissions, privacy and alternatives.
A Chrome extension's leaked OAuth tokens pivoted into Vercel's systems. Here's how to audit the extension OAuth grants in your work Google account.
An AI agent extension like OpenAI's Codex asks to 'read all data on all websites.' Here's what it really allows, why agents need it, and how to check yours.
Any zero-permission extension can hijack Claude's AI session and exfiltrate your Gmail or GitHub data. Here's how ClaudeBleed works and how to protect yourself.
LayerX found 82 Chrome extensions legally sell 6.5M users' data via buried privacy policies. Here's how the fine-print loophole works and how to check yours.
24 streaming extensions in the QVI Empire network legally sell your Netflix and Hulu viewing data. Privacy analysis, risk breakdown, and safer alternatives.
Five Chrome extensions stole Workday, NetSuite, and SAP session tokens using three attack vectors. Here's how enterprise teams can check and protect HR access.
The native messaging permission lets browser extensions talk to native apps outside Chrome's sandbox. Here's what it really enables — and how to check yours.
Some ad blockers that sell your data are among the most installed on Chrome. LayerX flagged 12 — here's the breakdown of the worst and safer 2026 alternatives.
A sideloaded browser extension is how UNC6692's SNOWBELT runs inside headless Edge, skipping Web Store review entirely. Here's how to detect it in your org.
AI browser assistant data collection can sweep up your SSN and medical data — UC Davis tested 9 GenAI extensions and found just that. Here's what they access.
Most TikTok downloader extension clones are spyware — StealTok spied on 130K users for up to a year. Here's the security breakdown and safer ways to download.
Chrome extension privilege escalation is real: CVE-2026-0628 let extensions with basic permissions reach your camera, mic, and files via the Gemini panel.
Georgia Tech's Arcanum study found 3,000+ Chrome extensions collect data silently — and none disclose it in their privacy policy. Here's how to check yours.
Firefox built-in VPN is free, capped at 50GB/month and 4 countries. Here's how it compares to Proton VPN, Mullvad, and NordVPN extensions — and which to trust.
GlassWorm malware compromised 72+ Open VSX IDE extensions to drop a Chrome infostealer that steals session cookies via Solana C2. Here's what to check today.
LinkedIn scanned 6,236 Chrome extensions to fingerprint users without consent. Here's how extension fingerprinting works and how to check if you're exposed.
Bitwarden vs 1Password security compared: permissions, audits, vault design, and the SquareX polymorphic spoofing attack Chrome still hasn't patched in 2026.
AI extension incident response, step by step: malicious AI extensions hit 20K+ enterprise tenants with no plan in place. Here's the 60-minute playbook.
The tabs permission lets Chrome extensions log every URL you visit in real time — no history permission needed. Here's what it does and how to audit yours.
Crypto wallet extensions are Torg Grabber's top target — 728 of them. Here's how MetaMask, Phantom, and Trust Wallet hold up on security and what to watch for.
ShadyPanda ran 145 malicious browser extensions on Chrome and Edge for 6 years — from affiliate fraud to keylogging spyware, 4.3M installs. How to check yours.
18 extensions harvested meeting data from 2.2M users on Zoom, Teams, and Meet. Here's how video conferencing extension access works — and how to audit yours.
18 Chrome, Firefox, and Edge meeting extensions with 2.2M installs secretly harvested corporate meeting data. Here's what they did and how to check yours.
Stanley MaaS sold guaranteed Chrome Web Store placement for $6,000. Here's how phishing extensions slip past Google's review — and how to protect yourself.
The scripting permission lets extensions run JavaScript on any page you visit — including your Zoom calls. Here's what that actually means for your privacy.
Incogni's 2026 study flags Grammarly and QuillBot as high-risk AI extensions. Privacy analysis, permission breakdown, and safer alternatives for 2026.
Browser extension host permissions let extensions read and change every website you visit. Here's what that warning actually means and when to be concerned.
The real Proton VPN extension is a standalone browser VPN — with broad permissions by design. Here's what it actually requests and how to spot the fakes.
A zero-permission extension can still drop malware: LayerX Labs showed any extension can silently backdoor your downloads. How to check and stay safe.
The cookies permission lets extensions read, write, and delete cookies — including session tokens. Here's what that means for your accounts and how to check.
Browser extension audit tools compared: LayerX, CrowdStrike Falcon, and Microsoft Defender. What each one does, where it falls short, and which fits your team.
QuickLens got hijacked via an extension ownership transfer to push ClickFix and crypto-stealing malware. Here's how to check your own add-ons are still safe.
Over 200 extensions silently pull email from Gmail and Outlook. Here's how extension email access works and how to check which add-ons can read your inbox.
ETH Zurich broke the zero-knowledge promise in Bitwarden, LastPass, and Dashlane with 25 attacks. See which password manager extensions actually held up best.
Any browser extension can silently inject commands into ChatGPT, Gemini, and Claude. Here's how man-in-the-prompt attacks work and how to keep yourself safe.
AI extension data collection is real: 52% of AI Chrome extensions collect user data. Here's what scripting permissions let them see, and how to check yours.
Is Urban VPN safe? Not after it quietly harvested ChatGPT, Claude and Gemini chats from 8M users. The full review, the timeline, and what to install instead.
A peer-reviewed study found Manifest V3 ad blocking matches MV2 effectiveness. Here's what declarativeNetRequest really changes if you build content filters.
Security researchers exposed 300+ malicious Chrome extensions with 37.4M downloads stealing data, credentials, and emails. Here's how to protect yourself.
WXT, Plasmo, CRXJS, Extension.js, and Bedframe — five browser extension frameworks compared by build time, bundle size, and maintenance health in 2026.
Mozilla now requires all Firefox extensions to declare data collection in manifest.json. Here's exactly how to implement data_collection_permissions correctly.
A researcher found 287 Chrome extensions allegedly leaking browsing history to third-party companies. Here's how it works and how to check yours.
30 fake AI Chrome extensions caught stealing credentials and Gmail data from 300K users. Here's how to check if you're affected and protect yourself.
17 malicious sleeper extensions found across Firefox, Chrome, and Edge with 840K downloads. They hid malware in images for up to 5 years undetected.