A browser extension runs inside the software you use every day, with permissions you granted once. When one turns malicious, it can read the pages you visit, capture what you type, and quietly send that data somewhere you never chose. This guide covers the warning signs, the permissions that make it possible, and a step-by-step plan to remove a suspicious extension and recover.
How an extension can spy on you
An extension's powers depend entirely on its permissions. A legitimate one blocks ads or manages passwords; a malicious one uses the same permissions to spy:
- Read the pages you visit, including form fields and private messages.
- Capture what you type, grabbing passwords and sensitive details before you hit enter.
- Inject ads into pages that never had them, earning money for the owner.
- Exfiltrate data to a remote server in the background while you browse normally.
None of this requires you to do anything wrong. The extension asks for access, and the browser grants it. That is why understanding extension permissions matters before you click install.
The warning signs
Malicious extensions rarely announce themselves, but they leave clues. Watch for:
- New ads appearing on sites that never had them, often low quality or mismatched.
- Unexpected redirects to pages or search results you did not request.
- Slow browsing caused by background data uploads.
- An unknown search engine or homepage suddenly set as your default.
- Pop-ups on sites that normally show none.
- New toolbar buttons or menu items you never installed.
These signs overlap with adware, a close cousin of spyware. The response is the same: identify the culprit and remove it.
The permission that enables most of it
When an extension asks to read and change all your data on all websites, it is asking for a lot: every page you open and every field you fill in, including logins and payment details. Many extensions genuinely need broad access, which is why the prompt is common and easy to ignore.
Treat that prompt as a moment of attention. Ask whether the task really needs every site, or only the few it works with. The how to check extension permissions guide shows exactly where to review this after installation.
What to do if you suspect spyware: a response plan
If you see warning signs, act in this order:
- Isolate the browser. Stop using it for anything sensitive (banking, email, work logins) until the issue is resolved.
- List your extensions. Open the browser's extension page and write down everything installed, with its permissions.
- Disable the suspect extension. Turn it off rather than deleting it yet — you may need its name and permission list for reference.
- Observe. Browse normally for a day with the extension disabled. If the symptoms stop, you have found the culprit.
- Remove it. Delete the extension from the browser.
- Check for changes it made. Restore your search engine and homepage, and clear site data if the extension could have accessed it.
- Rotate passwords for anything you typed while the extension was active, starting with email and banking. If you are unsure what it accessed, change passwords for your most important accounts and enable two-factor authentication.
- Scan your device with your security software in case the extension dropped anything else.
For a broader incident (suspected account compromise or data theft), the compromised extension response guide covers the full recovery process.
Why official stores are not risk-free
Downloading from an official store reduces risk but does not eliminate it. Stores review submissions but cannot catch everything, and threats change over time. Two patterns to know:
- Extension buyouts: a popular extension is sold to a new owner who ships an update that adds tracking. Google removed several extensions for policy violations after such changes in recent years.
- Compromised developer accounts: an attacker gains the developer's credentials and pushes a malicious update to an already-installed user base.
An extension you trusted for years deserves the same scrutiny as one you install today. CISA and the FTC both advise treating browser add-ons as software that carries risk.
How to audit what you have installed
- Compare current permissions against what the extension showed at install — updates can add access quietly.
- Read the changelog and recent reviews for complaints about ads, redirects, or new behavior.
- Note when your symptoms started and which extension updated around then.
- Remove extensions you do not use. A forgotten extension can still watch everything you do. The how to remove extensions guide covers the mechanics.
Prevention: keep the list small
The less software with broad access to your browsing, the smaller your surface for spyware. Install only what you need, choose extensions from developers you can verify, and remove anything you stop using. A short list is easier to trust and easier to check — that habit alone prevents most extension spyware problems.
Quick answers
How do I know if my browser has extension spyware? Look for ads on sites that never had them, unexpected redirects, a changed search engine, pop-ups, or noticeably slower browsing. Then review your extension list and permissions.
Can an official extension become spyware? Yes. Extensions can be bought out or compromised, and updates can add tracking after approval.
What does "read all data on all websites" mean? The extension can see every page you visit and everything you type, including logins and personal information. Grant it only when genuinely needed.
What should I do first if I suspect an extension? Stop using the browser for sensitive tasks, disable the suspect extension, and observe whether the symptoms stop before deleting it.
Written by Hassan Arshad, founder of UsefulOrbit. Last updated August 31, 2026. Sources: FTC Consumer Advice, CISA: Secure Our World, EFF Surveillance Self-Defense.