Abandoned browser extensions: how to check the add-ons that stopped getting security updates

You probably have an extension installed right now that nobody is maintaining. Not malware — just software that the developer published once, walked away from, and never touched again. It still runs. It still has whatever permissions you granted it. And it hasn't received a single security patch in years.

I pulled the numbers from our own catalog this week, and they're worse than I expected. Across the three big stores, abandoned extensions aren't the exception — in two of them, they're the majority.

The numbers: most extensions are quietly rotting

I looked at every extension in the Extenshi catalog with a known "last updated" date — that's basically all of them (exactly one Chrome listing was missing the field). Here's what the June 22, 2026 snapshot shows for extensions that haven't shipped an update in over 12 months:

• Chrome: 35.9% stale (75,604 of 210,647 listings)
• Firefox: 54.5% stale (48,972 of 89,880 listings)
• Edge: 67.3% stale (14,050 of 20,870 listings)

Stretch the window to six months and it gets bleaker fast: 52% of Chrome extensions, 71% of Firefox add-ons, and 77% of Edge extensions haven't been updated in half a year.

≥6 months≥12 months

The really old stuff is the part that worries me. More than half of Edge's catalog (53%) and over a third of Firefox's (36%) haven't been touched in two years or more. That's an extension last updated when Manifest V3 wasn't even mandatory yet, still sitting in your toolbar with access to the pages you visit.

Chrome looks healthier by comparison, but "healthier" still means one in three Chrome extensions is frozen in time. With 210,000+ Chrome listings, that's roughly 75,000 abandoned extensions on the store where most people shop for add-ons.

Why a frozen extension is a security problem

A stale extension isn't dangerous because it changed. It's dangerous because everything around it changed and it didn't.

Browser engines ship constantly. Chrome alone is moving to a two-week release cadence, and every release tightens APIs, deprecates old behavior, and — crucially — patches vulnerabilities. When a browser fixes a flaw in an extension API, extensions that depend on the old behavior have to update too. An abandoned one never does. It sits on the vulnerable pattern indefinitely.

The same goes for the libraries bundled inside extensions. When I looked at the third-party packages our scanners detect inside extension code, the hygiene picture is rough: of extensions shipping jQuery, 68% are on a version with at least one known vulnerability. For the xlsx spreadsheet library it's 97%; for gsap, 93%; for pdfjs-dist, around 60%.

That's a hygiene signal from version fingerprinting, not a confirmed exploit. But a maintained extension bumps these dependencies as fixes land, and an abandoned one ships the 2022 version forever.

Store policy is the third moving target. Firefox now requires every extension to declare its data-collection practices. Chrome keeps revising what permissions are allowed and how they're reviewed. An abandoned extension can't comply with rules written after its author left, which means it's increasingly likely to break, get delisted, or quietly fall out of policy without anyone noticing.

The Manifest V2 overlap makes Firefox a special case

There's a second pattern hiding inside the Firefox numbers, and it's worth pulling out. Chrome's catalog is now effectively 100% Manifest V3 — the old format is gone. Edge is at about 86% MV3. But Firefox is still only 31.5% MV3, which means roughly 61,000 of its add-ons are still running on Manifest V2.

Stack that against the abandonment data and you get the uncomfortable intersection: a large share of Firefox's catalog is both old format and unmaintained. Those are extensions written for a platform generation that Chrome already retired, by developers who've moved on. I dug into what the MV2 sunset actually stranded in my breakdown of Chrome's Manifest V2 removal — and Firefox keeping MV2 alive is a double-edged thing. It's a refuge for genuinely useful tools Chrome killed, but it's also a comfortable retirement home for software nobody is watching.

The lesson isn't "MV2 bad, MV3 good." It's that an extension's manifest version is one more signal of whether anyone is still steering it. A 2026 MV3 extension was at least touched recently enough to migrate. A still-MV2 Firefox add-on with a 2023 update date almost certainly wasn't.

The ownership-transfer trap

Here's the part that turns "annoying and outdated" into "actually dangerous." Abandoned extensions with real install counts are exactly what attackers shop for.

An extension with 50,000 users and a developer who stopped caring is a perfect acquisition target. The new owner inherits the install base, the granted permissions, and the auto-update pipeline — and the first sign you get is a malicious update arriving silently through the same channel you've always trusted. I broke down a real case of this in my earlier piece on extension ownership transfers, where a popular Chrome extension changed hands and pushed crypto-stealing malware to its existing users two weeks later.

Abandonment is what makes this market liquid. A developer who's still actively building isn't selling to a sketchy buyer. A developer who hasn't logged in for two years? They might not even read the email offering them a few thousand dollars for an extension they forgot they owned.

So when you stack the risks up, an abandoned extension is carrying unpatched API exposure, outdated vulnerable libraries, growing policy drift, and a standing invitation for an ownership-transfer attack. None of that requires the original developer to have done anything wrong. They just stopped.

Why this matters for you

You can't see any of this from the browser's extensions page. Chrome, Firefox, and Edge all show you the name, the icon, and a toggle — but not when the thing was last updated, not whether it's still maintained, and definitely not whether ownership changed hands.

That's the gap. The store listing has a "last updated" date buried on the detail page, but who's checking the store page for an extension they installed three years ago? Most of us install something, grant the permissions, and never think about it again. The extension becomes invisible — and invisible plus unmaintained plus permissioned is the exact profile that gets exploited.

This isn't a reason to panic and nuke every add-on you own. Plenty of stable, simple extensions genuinely don't need frequent updates. It's a reason to look — to know which of your extensions are actively maintained and which ones are running on autopilot.

How to check your own extensions

Here's the routine I'd actually follow. It takes about ten minutes.

1. List what you've got installed. Go to chrome://extensions (or edge://extensions, or about:addons in Firefox) and turn on developer mode. Read the whole list. You'll almost certainly find two or three you forgot existed — those are your first suspects.

2. Check the last-updated date for anything you rely on. Open each extension's store page and look for "Updated." If the most recent update is older than a year, treat it as unmaintained until proven otherwise. Cross-check it in the Extenshi catalog — search the extension by name and you'll see its update history and store presence in one place, without digging through three different store layouts.

3. Match permissions against the staleness. A stale to-do list extension is low risk. A stale extension that can read and change data on all websites is a different story. The combination of broad permissions and no maintenance is what you want to clear first. You can scan your installed extensions to see exactly what each one can touch.

4. Watch for the silent ownership swap. If an extension you've had for ages suddenly pushes an update after a long quiet stretch, or its description and developer name change, slow down. That's the pattern behind the ownership-transfer attacks. There's no shame in uninstalling and reinstalling from a fresh look at the listing.

5. Replace, don't just tolerate. If an extension you depend on has been abandoned, there's often a maintained alternative doing the same job. Search the catalog by category for what you actually need, and pick the one that's still shipping updates and has a clean security report.

How Extenshi helps

The reason I can even put these numbers in front of you is that we track update history and store presence across Chrome, Firefox, and Edge for the whole catalog — over 320,000 live listings — and run security scans on the slice we've fully analyzed (104,910 extensions and counting). Of the scanned, widely-installed extensions, the average overall risk score sits around 13 out of 100, but 935 of them land in the high-or-critical band. Staleness is one of the signals that feeds into how we flag an extension, alongside permissions, detected libraries, and threat-intel hits.

You don't have to manually audit three store pages per extension. Look your add-ons up, see what's maintained, what's risky, and what's quietly been abandoned — then decide what stays.

Scan your extensions →

---

This article is based on publicly available security research and Extenshi's first-party catalog data. Extenshi does not independently verify all claims made by third-party researchers. References to specific companies or products reflect the findings of cited sources and do not constitute accusations of intentional wrongdoing. If you believe any information is inaccurate, please contact us at [email protected].