Your Toolbar Is a Crime Scene: What 10 Popular Browser Extensions Actually Do With Your Data

There's a weird blind spot in how we think about privacy. We'll argue for hours about whether an app is scanning our messages, but the little icons sitting in our browser toolbar? Total strangers with front-door access, and most of us installed them back in 2019 and never thought about them again.

So I ran an experiment. Ten popular Chrome extensions, installed one at a time on a clean profile, with a simple rule: before I clicked "Add to Chrome," I had to read the privacy policy and audit every requested permission. No skipping. No "I'll trust this one because it has four stars."

What I found ranged from genuinely impressive to mildly horrifying.

The Permission Prompt Nobody Reads

Here's the thing about Chrome extension permissions: they're written in a language designed to sound boring. "Read and change all your data on all websites you visit." That sentence doesn't sound boring. It sounds like a ransom note. Yet it flashes by in two seconds and we click accept because the extension promises to block ads or save shopping receipts or turn our tabs into a productivity dashboard.

That particular permission — "all your data on all websites" — means the extension can read everything on every page you load. Your banking session. Your work email. That HR portal where you typed your salary negotiation notes. Everything.

A handful of the ten extensions I tested had it. Most of them didn't need it.

The Good, the Greedy, and the Uninstalled

The ones that earned a permanent spot:

• uBlock Origin remains the gold standard. Open source, no monetization scheme, and its permission requests map cleanly to what it actually does. When an ad blocker is free and open source, the business model question answers itself.
• Bitwarden requests broad-sounding access, but the code is open source and independently audited, and the extension only activates on pages where you invoke it. This is what "trust but verify" looks like in practice.
• Dark Reader was a pleasant surprise — clearly scoped permissions, active development, and a privacy policy you can read in under two minutes.

The middle of the pack:

A couple of the extensions — a screenshot tool and a tab manager — had acceptable permissions but privacy policies with language like "we may share data with trusted partners." Trusted partners is doing a lot of work in that sentence. Neither was doing anything obviously shady, but both were one acquisition away from becoming a data pipeline. I kept one, deleted the other, and honestly the decision was a coin flip.

Deleted on the spot:

• A popular shopping coupon extension that wanted access to all sites and had a policy explicitly stating it collects browsing history to "improve offers." Translation: it watches what you shop for and sells the signal.
• A grammar checker whose free tier's data-sharing language was longer than its feature list.
• A "free VPN" proxy extension, which is a category that shouldn't exist. If someone gives you a VPN for free, you're not the customer. You're the product being routed through someone else's server.

The Update Problem Nobody Talks About

Here's the part that surprised me most, and it wasn't in any single privacy policy. Extensions change. That cozy little tool you vetted in 2022 might get acquired, get a new owner, and ship an update that quietly expands its permissions. Chrome will show you a prompt — sometimes — but if the permission change is framed as "optional," it slides right past most users.

This has happened repeatedly in the real world. Ad blockers sold to shady buyers. Emoji keyboards turned into credential harvesters. The extension ecosystem has a supply chain problem, and your toolbar is the endpoint nobody patches.

The fix is boring but effective: audit your extensions every few months. Open chrome://extensions, click through each one, and ask two questions. Do I still use this? And do the current permissions still make sense? If the answer to either is no, that's an uninstall.

A Quick Field Guide

If you do nothing else after reading this, do these four things:

1. Prefer open source extensions with a public repo. Closed-source extensions ask you to trust a black box forever.
2. Be allergic to "all sites" permissions unless the tool genuinely needs them. An extension that only works on GitHub shouldn't be able to read your bank's website.
3. Read the privacy policy's data-sharing section first. Skip the intro fluff. Search for the words "third parties," "affiliates," and "share."
4. Check the last updated date. An extension abandoned two years ago is a security hole with a nice icon.

The Verdict

After all ten installs, my toolbar is leaner than when I started: an ad blocker, a password manager, and a dark mode toggle. That's it. Three icons, each one earning its place with scoped permissions and a policy I could actually defend out loud.

The humble extension toolbar might be the most overlooked attack surface on the average American's machine — sitting right there next to the address bar, one careless install away from reading everything you do online. Treat it like you'd treat a new app on your phone. Because functionally, that's exactly what it is.