How to Check Chrome Extension Safety Before Installing

Installing a Chrome extension can add useful features, but it can also expose you to malware, data theft, and privacy invasions. This guide shows you exactly how to vet any extension before you click “Add to Chrome,” so you can avoid malicious or poorly coded add-ons. You only need a few minutes and a web browser.

What You’ll Need

• A computer with Chrome or another Chromium-based browser (like Edge or Brave) installed.
• Internet access to research the extension.
• The exact name or URL of the extension you’re considering.

Step-by-Step

1. Find the official Chrome Web Store listing. Only install extensions from the Chrome Web Store. If you’re on a third-party site that offers a “direct download” or a .crx file, stop — that’s a major red flag. Search the Web Store for the extension by name, or click the link on the developer’s official website. Verify the URL starts with chrome.google.com/webstore.
2. Check the developer’s name and website. On the Web Store page, scroll to the “Additional Information” section. Look at the developer’s name and whether they have a linked website. A legitimate extension usually lists a real company or individual with a working site. If the developer has many unrelated extensions (e.g., a developer known for games suddenly makes a password manager), be suspicious.
3. Read the permissions list carefully. Click “Permissions” in the left sidebar (or scroll to “Permissions”). The extension will show what it can access. Ask yourself: does it need this access to function? For example, a screenshot tool might need “Read and change all your data on all websites” — that’s expected. But a simple timer extension asking for that same permission is a red flag. Watch for permissions like:
   • Read and change all your data on all websites
   • Manage your downloads
   • Capture content on any page
   • Access your browsing activity

   If the permission seems excessive for what the extension does, don’t install it.

4. Look at the rating and review count. A low rating (below 3 stars) or a very high rating with only a few dozen reviews can be a warning sign. Read the most recent 1-star and 3-star reviews — they often reveal bugs, hidden costs, or privacy issues. Also, check if the reviews mention “scam,” “malware,” “spyware,” or “unwanted ads.”
5. Check the “Last Updated” date. In the “Additional Information” section, you’ll see the last update date. If the extension hasn’t been updated in over a year, it may be abandoned. Abandoned extensions can become security holes because they don’t get fixes for new browser vulnerabilities.
6. Search for the extension name plus “review” or “safe”. Do a quick web search like “Extension Name review safe” or “Extension Name malware.” Look for independent reviews from tech sites or user forums. If you find multiple complaints about data theft or unwanted behavior, avoid it.
7. Check the source code (if it’s open source). Many reputable extensions are open source, meaning their code is on GitHub or GitLab. If the developer links to the source code, you can inspect it (or at least confirm it exists). If you’re not a programmer, you can still check if the repository has many stars or forks — that suggests community scrutiny. If the extension is not open source, that’s not automatically bad, but it means you have to trust the developer more.
8. Install it temporarily and test. If you’ve passed all the above checks, install the extension. But before you start using it, go to chrome://extensions (type this in the address bar). Find the extension and click “Details.” Look at the permissions again — they should match what you saw on the Web Store. Then, use the extension on a test page (like a blank tab or a site you don’t care about). Watch for:
   • Unusual pop-ups
   • Changes to your new tab page or search engine
   • Redirects to unfamiliar websites
   • Slowness or high CPU usage (check the Task Manager: Shift+Esc in Chrome)

   If anything seems off, remove it immediately.

9. Use Chrome’s built-in safety check. Go to chrome://settings/security and click “Check now” under “Safe Browsing.” This will scan your extensions for known threats. Also, enable “Enhanced protection” if you want more aggressive scanning.

Common Mistakes

• Ignoring the permissions because you’re in a hurry. The permission warning is the single most important clue. Don’t skip it.
• Trusting a high rating without reading the reviews. Some malicious extensions have thousands of 5-star reviews that are fake or bought.
• Installing from a pop-up or redirect. If a website forces you to install an extension to “continue watching” or “download a file,” that’s a classic malware vector.
• Assuming the Web Store is 100% safe. Google does scan extensions, but malicious ones slip through. The Web Store is safer than random sites, but it’s not foolproof.
• Keeping extensions you no longer use. Old, unused extensions are a common attack vector. Uninstall anything you don’t need.

Tips

• Use the “Incognito” setting to limit an extension’s access. In chrome://extensions, click “Details” on an extension, then toggle “Allow in Incognito” off if you don’t need it there.
• Create a separate Chrome profile for testing new extensions. That way, if one goes bad, your main profile and bookmarks are unaffected.
• Prefer extensions that are open source and have a clear privacy policy. A privacy policy that says “we collect no data” is a good sign.
• If you use a Chromium-based browser like Edge or Brave, the same steps apply. The Web Store is still the main source, but each browser has its own add-on store — use that one instead.
• Check the extension’s “Support” page (if listed) to see if the developer responds to issues. A responsive developer is a good sign.

Troubleshooting

• Extension won’t install. If you get an error like “This extension is not from the Chrome Web Store,” you may have downloaded a .crx file. Don’t try to force it — that’s a security risk. Instead, search the Web Store for the official version.
• Extension disappeared after a Chrome update. Chrome sometimes disables extensions that don’t meet new standards. Go to chrome://extensions and look for a warning. If it says “This extension may have been disabled because it’s not from the Chrome Web Store,” remove it and find an alternative.
• You suspect an extension is malicious after installing. Immediately remove it: go to chrome://extensions, click “Remove” on the extension. Then run Chrome’s safety check (chrome://settings/security → “Check now”). Also, reset your browser settings if you notice your homepage or search engine changed: chrome://settings/reset → “Restore settings to their original defaults.”
• Reviews are mixed and you’re still unsure. If you can’t decide, don’t install it. There are almost always alternative extensions that do the same thing. Search for “feature extension alternative” to find better-vetted options.
• The extension asks for more permissions after an update. That’s a red flag. Go to chrome://extensions, click “Details,” and read the new permissions. If they’re excessive, remove the extension and look for a more privacy-respecting alternative.

Frequently Asked Questions

Is it safe to install any extension from the Chrome Web Store?

No. While Google screens extensions, malicious ones do get through. You still need to check permissions, reviews, and the developer’s reputation.

What are the most dangerous permissions to look out for?

Be wary of “Read and change all your data on all websites,” “Manage your downloads,” “Capture content on any page,” and “Access your browsing activity.” These can let an extension steal passwords, track you, or inject ads.

Can an extension steal my passwords?

Yes, if it has permission to read and change data on all websites, it can inject scripts that capture keystrokes or read form fields. That’s why you should never enter passwords on a site if you’re unsure about an extension’s permissions.

What should I do if I already installed a suspicious extension?

Remove it immediately. Then run Chrome’s safety check and scan your computer with a reputable antivirus. Change your passwords for any accounts you accessed while the extension was active, especially if you use the same password across sites.

Are extensions that are open source automatically safe?

Not automatically, but open source is a good sign because anyone can audit the code. However, the version you install might not match the public source code, so it’s not a guarantee. Still, it’s better than closed-source.

How often should I review my installed extensions?

At least once a month. Go to chrome://extensions and remove any you don’t use. Also, check the “Last updated” date for each one — if any are outdated, consider replacing them.

Related

• Fix Status Range List Conflict 0xc0000282 in Windows
• Fix Software Not Uninstalling on Windows 10
• Hard Drive Missing Windows 10? Fixes That Work