63 articles found
Dozens of hidden Chrome extensions with ~6M users ran obfuscated tracking code. What 'hidden' listings mean, how the tracking hides, and how to check yours.
Mailtrack vs Boomerang vs Streak, plus Right Inbox and Gmelius: Gmail extension privacy judged by their real Chrome manifests and policies, not marketing.
The August 2026 Chrome Web Store policy update bans AI-jailbreak extensions and tightens data rules. Here's what changed and how to check your own extensions.
Chrome Gemini Skills now does what AI sidebar extensions charge for. I compared permissions, security records, and privacy to decide which one to trust.
Compare MozBar, Ahrefs, SEOquake, Keywords Everywhere and Similarweb: page access, privacy disclosures and on-click controls. Choose a toolbar with confidence.
What does clipboardRead let a Chrome extension access? Compare clipboard permissions with copy-and-paste events, then check which installed tools need access.
The privacy permission lets an extension flip Chrome's own switches — Safe Browsing, autofill, WebRTC, cookies. Here's what it changes and how to check yours.
Cookie extensions touch your session tokens and every site you visit. I compared Cookie-Editor, Cookie AutoDelete and the banner blockers on who owns them.
Socket found 737 fake VPN extensions routing Chrome browser traffic through one operator's SOCKS5 proxies. Here's how to check yours and reset the damage.
Replacing your new tab page takes no permission at all. Here's what a new tab override extension can really see, when it's fine, and how to check yours.
I compared three text-to-speech extensions on one question: does the text on your screen stay on your device, or does someone else's server read it first?
Mozilla's W3C proposal puts AI agent permissions on the browser's extension model. I counted that model at scale: 300,503 extensions, 12,277 already pulled.
The downloads permission lets an extension read every file you've downloaded, write new ones, and hide the download UI. Here's what it allows and how to check.
I compared four PDF extensions on permissions and where your documents go. Which upload your files, which stay local, and what the Adobe Acrobat flaw exposed.
The debugger permission gives an extension full Chrome DevTools Protocol access — cookies, keystrokes, any page. Here's what it allows and how to check yours.
Are volume booster extensions safe? I break down the permissions, the 1.5M-user sleeper spyware LayerX found, and how to spot a sound booster worth trusting.
The webNavigation permission lets an extension watch every URL you open live — no host permissions, no injected code. Here's what it sees and how to check.
I compared four popular website blocker extensions on permissions and data sharing. Here's which focus tools keep your browsing private and which don't.
CWS data-minimisation rules enforce August 1. Firefox 153 ships tomorrow. Firefox and Safari just lined up behind COOP/COEP for extension pages.
The management permission lets a browser extension list every other extension you've installed and toggle them off. Here's what it exposes and how to check.
Screen recorder extensions can reach your camera, mic and every tab. Here's the permission breakdown, the Screencastify webcam bug, and how to record safely.
The storage permission is the most-requested thing extensions ask for — 62% claim it, with no install warning. Here's what it keeps, where, and how to check.
Firefox 153 makes extension file access opt-in from July 21 — even for add-ons you already installed. We found 842 Firefox add-ons that request file:// access.
The proxy permission lets a browser extension reroute all your traffic through servers it controls. Here's what it really allows — and how to check yours.
I compared four web clipper extensions on permissions and data flow. Which read every page you visit, which stay local, and which one I'd actually trust.
The unlimitedStorage permission lets extensions hoard data on your disk with no cap. ~687M users are exposed — and W3C is debating a limit on July 2, 2026.
The activeTab permission lets browser extensions touch the page you're on — only when you click, with no scary install warning. Here's what it grants.
I compared four popular tab manager extensions on permissions, data sync, and privacy. Here's which keep your tab list local and which ship it to the cloud.
A disabled extension can't clear its uninstall URL (setUninstallURL) before removal — the service worker is already dead. Here's why, and the server-side fix.
The history permission lets a browser extension read every site you visited — even before you installed it. Here's what it exposes and how to check yours.
SponsorBlock, Return YouTube Dislike and Enhancer for YouTube checked on permissions, privacy, and how to spot risky clones.
The webRequest permission lets browser extensions watch — and sometimes rewrite — every network request you make. Here's what it really sees and how to check.
Translation extensions read the full text of every page you translate. I review Google Translate, DeepL, and Immersive Translate on permissions and data flow.
An ACM study found 15.97% of extensions start third-party tracking within 60 seconds. Here's why the permission list never told you, and how to check.
Coupon and cashback extensions watch every site you visit. I review Honey, Rakuten, and Capital One Shopping on permissions, privacy, and the affiliate mess.
I mapped browser extension permissions across 308,210 live listings: 62% claim storage, 7.4% can read every site you visit. Here's what to pause on.
A privacy researcher says Chrome ships almost no fingerprinting defenses. Here's what sites can really learn about you — and which extensions help.
Screenshot extensions can read every page they capture. Here's the permission breakdown, what the ShotBird hijack revealed, and how to grab screens safely.
The NordVPN extension's new on-device AI voice detector flags deepfake audio without sending anything anywhere. Review of permissions, privacy and alternatives.
An AI agent extension like OpenAI's Codex asks to 'read all data on all websites.' Here's what it really allows, why agents need it, and how to check yours.
LayerX found 82 Chrome extensions legally sell 6.5M users' data via buried privacy policies. Here's how the fine-print loophole works and how to check yours.
24 streaming extensions in the QVI Empire network legally sell your Netflix and Hulu viewing data. Privacy analysis, risk breakdown, and safer alternatives.
The native messaging permission lets browser extensions talk to native apps outside Chrome's sandbox. Here's what it really enables — and how to check yours.
Some ad blockers that sell your data are among the most installed on Chrome. LayerX flagged 12 — here's the breakdown of the worst and safer 2026 alternatives.
AI browser assistant data collection can sweep up your SSN and medical data — UC Davis tested 9 GenAI extensions and found just that. Here's what they access.
Most TikTok downloader extension clones are spyware — StealTok spied on 130K users for up to a year. Here's the security breakdown and safer ways to download.
Georgia Tech's Arcanum study found 3,000+ Chrome extensions collect data silently — and none disclose it in their privacy policy. Here's how to check yours.
Firefox built-in VPN is free, capped at 50GB/month and 4 countries. Here's how it compares to Proton VPN, Mullvad, and NordVPN extensions — and which to trust.
LinkedIn scanned 6,236 Chrome extensions to fingerprint users without consent. Here's how extension fingerprinting works and how to check if you're exposed.
The tabs permission lets Chrome extensions log every URL you visit in real time — no history permission needed. Here's what it does and how to audit yours.
18 extensions harvested meeting data from 2.2M users on Zoom, Teams, and Meet. Here's how video conferencing extension access works — and how to audit yours.
18 Chrome, Firefox, and Edge meeting extensions with 2.2M installs secretly harvested corporate meeting data. Here's what they did and how to check yours.
The scripting permission lets extensions run JavaScript on any page you visit — including your Zoom calls. Here's what that actually means for your privacy.
Incogni's 2026 study flags Grammarly and QuillBot as high-risk AI extensions. Privacy analysis, permission breakdown, and safer alternatives for 2026.
Browser extension host permissions let extensions read and change every website you visit. Here's what that warning actually means and when to be concerned.
The real Proton VPN extension is a standalone browser VPN — with broad permissions by design. Here's what it actually requests and how to spot the fakes.
The cookies permission lets extensions read, write, and delete cookies — including session tokens. Here's what that means for your accounts and how to check.
Over 200 extensions silently pull email from Gmail and Outlook. Here's how extension email access works and how to check which add-ons can read your inbox.
AI extension data collection is real: 52% of AI Chrome extensions collect user data. Here's what scripting permissions let them see, and how to check yours.
Is Urban VPN safe? Not after it quietly harvested ChatGPT, Claude and Gemini chats from 8M users. The full review, the timeline, and what to install instead.
A peer-reviewed study found Manifest V3 ad blocking matches MV2 effectiveness. Here's what declarativeNetRequest really changes if you build content filters.
Mozilla now requires all Firefox extensions to declare data collection in manifest.json. Here's exactly how to implement data_collection_permissions correctly.
A researcher found 287 Chrome extensions allegedly leaking browsing history to third-party companies. Here's how it works and how to check yours.