Extenshiextenshi.io/blog
Back to articles
extension-reviewchrome-extensionsfirefoxedgedata-storycomparisonextension-ratings

Hidden gems vs coasting incumbents: what 16,501 rated extensions say about stars and installs

Install counts and extension ratings disagree more often than you think. I split 16,501 rated extensions into hidden gems and coasting incumbents — the data.

Maxim Kosterin
10 min read
Two hairline puzzle-piece outlines side by side on paper-white; the smaller one filled with a soft orange watercolor wash, the larger one left bare with a faint drift of dust along its bottom edge.
Two hairline puzzle-piece outlines side by side on paper-white; the smaller one filled with a soft orange watercolor wash, the larger one left bare with a faint drift of dust along its bottom edge.

Open any extension store and the default sort is popularity: the install count on the tile, the star rating underneath. Most people pick from the top few results and move on. I ran install counts against extension ratings across every catalog listing with enough reviews to take seriously. They disagree more often than they agree.

I run the Extenshi catalog, which tracks listings across the Chrome Web Store, Firefox Add-ons and Edge Add-ons. In the August 24, 2026 snapshot, 16,501 listings had a rating, an install count and at least 20 reviews: the slice where a star average means more than one enthusiastic reviewer. Comparing each listing against its store's own medians splits it into one of four quadrants. Two of them matter.

Hidden gems sit below the install median but at or above the rating median: underexposed, yet well-liked by the people who use them. Coasting incumbents are the mirror image: installs at or above the median, rating below it. In Chrome's 12,117 rated listings the two groups are nearly equal, 3,666 gems against 3,764 coasters. Together they are 61% of the rated shelf.

For most extensions you can form an opinion about, popularity and satisfaction point in opposite directions.

Quick verdict

All catalog numbers are from the Extenshi snapshot of August 24, 2026, over listings with a rating, a known install count and at least 20 reviews (16,501 of 362,889 live listings).

Gems and coasters are equally common. Chrome splits into 3,666 hidden gems vs 3,764 coasters. Firefox and Edge show the same near-symmetry at smaller scale.

Big numbers and badges can be part of the con. The AiFrame campaign put 30 fake AI assistants in front of more than 260,000 users, and several of them carried the Chrome Web Store's Featured badge.

Stars measure satisfaction, not safety. In Incogni's study of 442 AI-powered Chrome extensions, 52% collected user data. No star average shows that.

Monetization predicts nothing. Firefox add-ons flagged as needing payment average 3.84★ vs 4.14★ for the rest. Chrome listings with in-app purchases are a wash (4.32 vs 4.30).

Bottom line: shortlist with stars and installs; decide on upkeep, permissions and developer.

Extension ratings vs installs, store by store

Chrome Firefox Edge
Rated listings (20+ reviews) 12,117 3,345 1,039
Hidden gems (below-median installs, at/above-median rating) 3,666 817 319
Coasting incumbents (at/above-median installs, below-median rating) 3,764 814 313
Median installs among rated listings 8,000 1,585 22,992
Median rating 4.47★ 4.29★ 4.50★

The medians do the defining, so read the buckets as store-relative. A Chrome "gem" is anything under 8,000 installs that rates 4.47★ or better; on Edge the bar is 22,992 installs and 4.50★. A listing in two stores counts once per store.

Also worth absorbing: 16,501 is under 5% of the 362,889 live listings. The typical listing has fewer than 20 reviews, which is too thin a rating history to judge. Ratings aren't equally dense either: Firefox users leave about three times as many per install as Chrome users, Edge users under a quarter as many. I unpacked that machinery, and why the top 1% of Chrome listings hold 92% of installs, in the three-store comparison.

Big numbers can be part of the con

An install count tells you how well an extension has been distributed so far. That's a marketing outcome, not a safety verdict, and a big number can be part of the pitch.

In February, LayerX researchers published the AiFrame campaign: 30 Chrome extensions posing as AI assistants, all sharing one codebase and backend, with more than 260,000 users combined. BleepingComputer's report counted more than 300,000 and described the extensions stealing credentials and email content. The researchers note that several of them were Featured by the Chrome Web Store, which raised their perceived legitimacy. The real interface loaded from a remote server, so the code the store reviewed wasn't what decided their behavior.

Even without fraud, the legit dynamics skew the number. Installs concentrate hard on a sliver of listings, and most publishers have shipped exactly one extension ever. "I've never heard of it" is a weak signal in a market shaped like that.

Stars don't read code

Ratings have the opposite problem: they measure whether people like the feature, not what the code does. A store tile shows an average and a count. It doesn't show what the package asks for or where your data goes.

Incogni's 2026 study of 442 AI-powered Chrome extensions puts numbers on that gap (Help Net Security's coverage has the highlights). 52% collected user data, 29% collected personally identifiable information, and 42% used the scripting permission, which lets an extension run code inside web pages. None of that shows up in a star average. A 4.6★ writing assistant can be delightful and a data firehose.

Store review doesn't close the gap either. Mozilla's own guide to assessing an extension says the scanning and human review on addons.mozilla.org don't make an add-on "absolutely 100% safe."

The gem trap: underrated, or just new?

A hidden gem is a hypothesis, not a verdict. Below-median installs plus strong ratings can mean an underappreciated treasure. They can also mean a listing six weeks old, a hobby project about to be abandoned, or a look-alike borrowing a bigger brand's search traffic.

Our cohort data shows how fast the shelf churns. Of the extensions first captured during the 2026 Q2 crawl, which is most of the current catalog, just 34.6% shipped an update in the six months before the snapshot. (Discovery date is when we first saw a listing, not its true store birthday.)

Roughly 77% of the 205,522 distinct publisher names in our catalog carry a single listing (approximate, since names are free text). So a gem from a first-time publisher carries real abandonment risk: upkeep stops, dependencies age, and the listing keeps every permission you granted it. That failure mode is the subject of my post on abandoned extensions. The short version: check the last-updated date before you fall in love.

Two more failure modes wear the gem costume. Ownership transfers: a promising listing gets sold and turns malicious, like the QuickLens case I covered in March or the ShotBird hijack. And look-alikes: researching the real Mailtrack, I found a near-identical "MailTrack" listing with 53 users and no developer name that declared authentication data and location access. A small install count tells you nothing about which listing is genuine (details in the Gmail review).

Does paying make an extension better?

If price were a quality signal, monetized listings would rate higher. In our snapshot, they don't.

Store No payment flag Payment flag Avg rating, no flag Avg rating, flagged
Chrome 224,130 (92.6%) 18,036 (7.4%) 4.30★ 4.32★
Firefox 95,448 (97.0%) 3,002 (3.0%) 4.14★ 3.84★
Edge 22,273 — 4.26★ —

Coverage: Chrome's flag is the store page's in-app purchases notice; Firefox's is the add-on's "requires payment" flag on addons.mozilla.org, which also covers paid services and extra hardware. Our Edge data has no equivalent field. Rating averages cover 20+ review listings only.

Chrome listings with in-app purchases rate the same as the rest of the shelf. Firefox's flagged add-ons rate clearly worse, plausibly small samples plus higher expectations from people who paid.

The more useful reading is the inverse one. When 92.6% of Chrome listings don't even offer in-app purchases, the interesting question isn't "should I pay" but "if I'm not paying, what's the business model?" Sometimes it's a subscription upsell, which is fine. Sometimes it's data about your browsing, sold or shared, also legal and disclosed in a policy nobody reads.

A two-minute vet that beats the store tile

Mozilla's guide runs the checks in a sensible order: who the developer is, how many users and reviews the listing has, then whether the permissions match the features. Here's a version that takes about two minutes per candidate:

  1. Last-updated date first. A gem that hasn't shipped in a year is a coaster in waiting.
  2. Permissions vs job description. A to-do tool asking to read every website you visit is a red flag no star average excuses.
  3. Review count, not just the average. Our gem math requires 20+ reviews for a reason. Below that, one person's mood is the rating.
  4. The developer line. One listing ever, or a portfolio? A solo debut isn't disqualifying; it just raises the weight on steps 1 and 2.
  5. Renames and ownership churn. A listing whose name or developer recently changed deserves extra suspicion.
  6. Then check the finalist. Paste its store URL into a catalog report and read what the package actually asks for.

FAQ

How many installs is "enough" for an extension? No threshold implies safety. For calibration, the median rated Chrome listing sits at 8,000 installs; on Firefox, about 1,600. Below-median isn't bad, since that's where the gems live, but fewer people have stress-tested the listing. Lean harder on upkeep and permission checks.

Are highly rated extensions safe? Stars measure satisfaction. Some of AiFrame's fake assistants carried the store's Featured badge, and Incogni found that half of the AI extensions it studied collect user data. Ratings plus review count get you a shortlist; permissions, update history and a code scan get you a verdict.

How do I find hidden gems myself? Store sorting is too blunt: you can't filter for "below-median installs, above-median rating." Search the catalog instead. Each page carries the published package's permissions alongside the scanner findings, so you can compare two candidates side by side.

Final recommendation

  • Shortlist with stars and installs; decide with upkeep, permissions and developer. The tile numbers disagree for about six in ten rated Chrome listings.
  • Treat a gem as a hypothesis. Confirm it's still alive: recent update, real developer, permissions that match the job.
  • Treat a coaster as a warning. A large install base with a below-median rating means many people use it and plenty of them aren't happy. Read the recent low-star reviews before you join them.
  • Ignore price as a quality signal. The business model behind "free" matters more than the price tag.
  • Check each finalist before you install, and re-check the ones you already have after major updates.

Check an extension → — paste a store URL (Chrome, Firefox or Edge) and get that one extension's security report.

Scan the extensions you installed from a store with Guard → — npx @extenshi/guard scan checks what's already in your browsers against the catalog; free account needed.

Sources

This article is based on publicly available security research and news reporting, plus first-party Extenshi catalog aggregates. Extenshi does not independently verify all claims made by third-party researchers. References to specific companies or products reflect the findings of cited sources and do not constitute accusations of intentional wrongdoing. If you believe any information is inaccurate, please contact us at [email protected].

Related Articles