24 articles found
The storage permission is the most-requested thing extensions ask for — 62% claim it, with no install warning. Here's what it keeps, where, and how to check.
The proxy permission lets a browser extension reroute all your traffic through servers it controls. Here's what it really allows — and how to check yours.
The unlimitedStorage permission lets extensions hoard data on your disk with no cap. ~687M users are exposed — and W3C is debating a limit on July 2.
The activeTab permission lets browser extensions touch the page you're on — only when you click, with no scary install warning. Here's what it grants.
A disabled extension can't clear its uninstall URL (setUninstallURL) before removal — the service worker is already dead. Here's why, and the server-side fix.
The history permission lets a browser extension read every site you visited — even before you installed it. Here's what it exposes and how to check yours.
The webRequest permission lets browser extensions watch — and sometimes rewrite — every network request you make. Here's what it really sees and how to check.
chrome.runtime.setUninstallURL opens a page after someone uninstalls your extension. Here's how to turn that uninstall moment into structured churn feedback.
An ACM study found 15.97% of extensions start third-party tracking within 60 seconds. Here's why the permission list never told you, and how to check.
I mapped browser extension permissions across 308,210 live listings: 62% claim storage, 7.4% can read every site you visit. Here's what to pause on.
A privacy researcher says Chrome ships almost no fingerprinting defenses. Here's what sites can really learn about you — and which extensions help.
LayerX found 82 Chrome extensions legally sell 6.5M users' data via buried privacy policies. Here's how the fine-print loophole works and how to check yours.
The native messaging permission lets browser extensions talk to native apps outside Chrome's sandbox. Here's what it really enables — and how to check yours.
AI browser assistant data collection can sweep up your SSN and medical data — UC Davis tested 9 GenAI extensions and found just that. Here's what they access.
Georgia Tech's Arcanum study found 3,000+ Chrome extensions silently collect your data — and none disclose it in their privacy policy. Here's how to check.
LinkedIn scanned 6,236 Chrome extensions to fingerprint users without consent. Here's how extension fingerprinting works and how to check if you're exposed.
The tabs permission lets Chrome extensions log every URL you visit in real time — no history permission needed. Here's what it does and how to audit yours.
Eighteen extensions harvested meeting data from 2.2 million users across Zoom, Teams, and Meet. Here's how conferencing access works and how to audit yours.
The scripting permission lets extensions run JavaScript on any page you visit — including your Zoom calls. Here's what that actually means for your privacy.
Browser extension host permissions let extensions read and change every website you visit. Here's what that warning actually means and when to be concerned.
The cookies permission lets extensions read, write, and delete cookies — including session tokens. Here's what that means for your accounts and how to check.
LayerX, CrowdStrike Falcon, and Microsoft Defender all offer enterprise browser extension auditing now. Here's what each does and which fits your team.
Over 200 extensions silently extract email data from Gmail and Outlook. Here's how DOM access works and how to check which add-ons can read your inbox.
Any browser extension can silently inject commands into ChatGPT, Gemini, and Claude. Here's how man-in-the-prompt attacks work and how to stay safe.