Practical guide

How to tell if a Chrome extension is safe

Ratings and store descriptions are useful, but they cannot tell you everything. Check whether the access an extension requests matches what its code actually does.

Before you install

Start with purpose. A simple color picker should not need every page you visit, browsing history, cookies, or downloads.
Read the permission warnings. Access to all websites lets code run on a very broad part of your browsing. Treat it as powerful, not automatically malicious.
Check the publisher and recent changes. A popular extension can change owners or behavior. Recent reviews sometimes reveal a sudden shift.
Look for data leaving the browser. Analytics can be ordinary, but browsing URLs, form contents, identifiers, cookies, or account data sent to unexplained servers deserve scrutiny.
Check the current version’s code. The store listing describes intent. The package shows implementation.

Warning signs worth investigating

Remote code or instructions that can change behavior without a Web Store update
Code that rewrites links, search results, checkout pages, or form destinations
Tracking across unrelated websites
Cookie or session access unrelated to the extension’s purpose
Heavily hidden code combined with broad permissions or unexplained network traffic

What is not automatically dangerous

Minified JavaScript, analytics, broad host access, or an eval() match can each have legitimate explanations. The important question is how the behavior is reached, what data it handles, and where that data goes.

Want evidence from the current package? Paste its Chrome Web Store link into ExtensionSafe. Cached reports are free to view.