How to Audit Chrome and Edge Extensions on Windows 10 and 11

Why your extensions deserve a second look​

An extension is a small program that runs inside the browser you use for banking, email, admin portals and everything else. Many extensions ask to read and change data on the sites you visit. That access is often legitimate. An ad blocker can't block ads on a page it can't see. But if the developer goes bad, sells the project, or has the update channel hijacked, the same access becomes a problem.

How-To Geek lists the possible harms as browser hijacking, remote access, identity theft and keylogging. It also points out that an extension that was safe when you installed it won't necessarily stay that way. We agree, and that's the main reason to review extensions periodically instead of vetting them once.

Google's own extension-review documentation gives a blunt example of the risk. It says host permissions such as <all_urls> give an extension broad access to your web activity. An extension with that access can collect browsing history, hijack search behaviour, scrape data from banking websites or harvest credentials.

Section summary: Extensions run with real access to your browsing. Safe at install time doesn't mean safe forever.

What a real malicious extension looks like​

How-To Geek mentions a 2025 phishing operation that force-installed extensions to steal data when victims visited their banks. It says the targets were mostly in Brazil, Mexico, Vietnam and Colombia. We couldn't fully verify that country list or the description of a "network" of attacks against a primary source, so treat those details with caution.

A separate 2025 case is well documented. IBM Trusteer analysed a campaign it calls BlackStink, which used a malicious Chrome extension aimed at Latin American banking portals. IBM's findings show how these attacks work:

• Disguise: The extension posed as a Google Docs service and had a Spanish-language name.
• Reach: Its content scripts ran on <all_urls> and in all frames, so its code ran on every site and inside embedded frames.
• Permissions: It requested activeTab, webNavigation, storage, tabs and scripting. That was enough to detect visits to banking sites, inject fake forms and overlays, and steal data.
• Off-store updates: A hardcoded update URL pointed at a typosquatted domain. That let the attackers push new versions without going through Chrome Web Store review.
• Delivery: IBM notes that victims often don't knowingly install extensions like this. Malware from the initial infection quietly adds them to the browser, bypassing the store entirely.

That last point matters most for Windows users. If something was force-installed or sideloaded, being careful about what you click in the store wouldn't have stopped it. Only a review of what's actually installed will find it. IBM's own advice after the analysis is the same as How-To Geek's: review your installed extensions and remove any that are unnecessary or unfamiliar.

Section summary: Real campaigns use fake-looking extensions with broad permissions and off-store updates. Often the victim never installed them on purpose.

Two corrections​

The 86% statistic. How-To Geek says about 86% of Chrome extensions ask for a lot of permissions. We couldn't trace that number to a study that actually measures that. The 86% figures we found in research papers measure different things. Until someone produces a matching source, don't repeat it.

uBlock Origin and Chrome. How-To Geek is right that the original uBlock Origin no longer works in Chrome because Manifest V2 support is gone, and that uBlock Origin Lite is the replacement there. Here is the timeline from Google's documentation:

Google says existing MV2 installs on Chrome 138 or earlier will keep running, but they can't get updates or be reinstalled if removed. In other words, an unmaintained extension that no longer gets patches is exactly what this cleanup is meant to catch. The change applies to Chrome specifically. How-To Geek says uBlock Origin still works in Firefox and Opera. We didn't independently check those listings, so confirm for your own browser.

The author also recommends downloading uBlock Origin only from its official developer, Raymond Hill, and avoiding look-alikes with similar names. That applies to any popular extension, because copycats like to borrow trusted names.

How to audit extensions in Microsoft Edge​

On Windows 11 and Windows 10, Microsoft documents these steps:

1. Open the list. In Microsoft Edge, select Extensions located to the right of your browser address bar, then select Manage extensions. If you don't see Extensions to the right of your browser address bar, select Settings and more > Extensions. You can also type edge://extensions in the address bar.
2. Disable before you delete, if you're unsure. Select the toggle next to the extension you want to turn off. If nothing breaks after a week, you probably didn't need it.
3. Narrow its access. Open the extension's Details page. According to a 2026 Technobezz guide, under Site access, you can manage allowed sites, Allow in InPrivate, and Allow access to file URLs. How-To Geek's author says they never let an extension access local files. Unless an extension really needs file URLs, leave that toggle off.
4. Remove it. Microsoft's instructions: right-click the icon of the extension you want to remove (to the right of your browser address bar), then select Remove from Microsoft Edge > Remove. If it isn't pinned to the toolbar, locate it under Installed extensions, select Remove, then select the Remove button on the small prompt window.

Work PCs: On a work or school device, your organization can allow, block, force-install, or manage extensions through Microsoft Edge management tools. If an extension won't uninstall, it may be enforced by policy. Microsoft's Edge extensions FAQ covers removing policies that may be enforcing an extension. On a managed machine, talk to IT before touching policy settings. On a home PC, an extension you didn't install that's enforced by policy is a red flag and worth a full malware scan.

How to audit extensions in Google Chrome​

Google's Chrome Help documents the same tasks:

• Open the list: Select More > Extensions > Manage extensions.
• Limit site access: Open Details. Next to the setting that lets the extension read and change your data on websites, choose to grant access when you click the extension, on specific sites only, or on all sites.
• Check for corruption: If an extension still shows as corrupted after you select Repair, Google says another program may be changing its files. Run antivirus or anti-malware software on Windows and remove any suspicious programs.
• Watch for bundled installs: Chrome warns that installing an app on Windows can also install a Chrome extension. The next time you open Chrome, you'll be asked to Enable or Remove it. Choose Remove if you didn't ask for it.
• Run Safety Check: Google's Chrome Security Team says the top of chrome://extensions warns about extensions suspected of containing malware, ones that break store policy, ones the developer has unpublished, ones not from the Web Store, and ones with no published privacy practices.

What success looks like​

When you're done, every remaining extension should pass three tests:

• You can say what it does and why you still need it. How-To Geek's question is a good filter: does this actually improve your browsing?
• Its permissions match its job. Google's security team advises comparing an extension's stated purpose with the permissions it requests, and considering removal when they don't match. UC Berkeley's Information Security Office adds that if an installed extension suddenly asks for new permissions and you can't find a reason, uninstalling is probably the better choice.
• It comes from a source you've verified and is still maintained. An extension its developer has unpublished is one Chrome specifically flags.

Common problems​

• "I don't know what this extension is." Disable it first, look up its store listing and developer, then decide. If you can't identify it, remove it and run a malware scan. As IBM's research shows, unexplained extensions are sometimes the visible sign of a deeper infection.
• "It won't uninstall." That usually means policy enforcement. See the work-PC note in the Edge section.
• "Updating fixes everything, right?" No. Updates deliver fixes, but they're also how a compromised developer account pushes a malicious version. That's why How-To Geek's author checks what changed in an update before installing it. Few people will do that for every extension, but for anything with access to all sites, it's reasonable.
• "The store reviewed it, so it's safe." Store review helps but doesn't guarantee anything. Google says that in 2024, under 1% of Chrome Web Store installs were found to include malware. That's a low rate, but across billions of installs it still adds up. Google also says reviews of already-published extensions can end in takedowns, and confirmed malware is disabled on users' devices.

Our take​

How-To Geek's piece is more a personal habit than a security advisory, and a couple of its specifics needed correcting. The central advice holds up. The UC Berkeley security office puts it simply: every extension you add enlarges your attack surface. Keep fewer extensions, give each one only the access it needs, and check them regularly.

If you're going to spend a few minutes on year-end maintenance, this is a good use of them, and it's free.