A Chrome add-on was sold and later updated to harvest data from users’ web activity. The case highlights why permissions and ownership need checking long after installation.
Browser extensions have become one of the easiest ways to add useful functions to Chrome, Edge, Firefox and Safari. They are also one of the easiest ways to expose everything you do online. The uncomfortable reality is that an extension may be safe when you install it and become dangerous later, after an automatic update or a change in ownership.
A recent case examined by Annex Security shows why that matters. QuickLens, a Chrome extension that added Google Lens integration, appeared in the Chrome Web Store in October 2025 and was listed for sale just two days later. According to Annex, it changed owner on 1 February 2026 and then received version 5.8 on 17 February, which preserved the original feature while stripping security headers from visited sites and fetching code from an external server every five minutes. The extension had about 7,000 users, all of whom received the malicious update automatically.
Microsoft Defender has described a similar but larger campaign involving Chromium extensions posing as artificial intelligence assistants. In March 2026, Microsoft said the operation reached roughly 900,000 installs and collected full web addresses together with content from chats on services such as ChatGPT and DeepSeek. Because Edge supports Chrome extensions, the same add-ons could run in both browsers, and Microsoft warned that disabling data collection in one version did not necessarily remain effective after later updates.
The lesson is that extension risk is not a one-time decision. It is a continuing trust relationship with whoever controls the developer account and the update channel. Annex’s report makes that plain: a featured, legitimate-looking extension can change hands and be repurposed without any action from the user. That is why the safest approach is to review extensions regularly, not only when you first install them.
The most important permission to inspect is the ability to read and change data on websites. Mozilla says that a Firefox extension with access to all websites can read page content and anything entered into forms, including usernames and passwords. That level of access is reasonable for password managers, shopping tools or ad blockers, but it is also powerful enough to make the extension as sensitive as a trusted financial service. Google’s Chrome support pages give users three levels of control: an extension can be allowed only when selected, on specific sites, or on all sites. For occasional tools, the narrowest option is usually sufficient.
Each browser offers a straightforward place to check these settings. Chrome lets users manage site access from the extensions menu, while Microsoft says Edge users should review the permissions prompt before installing, including when the extension comes from the Chrome Web Store. Apple’s Safari guidance says to use the extension controls in the toolbar or settings to decide how much access each add-on gets, and Mozilla notes that Firefox users can also manage local file permissions from each extension’s settings page. In all four browsers, the principle is the same: if an extension does not need broad access, do not grant it.
There are also warning signs that an extension may have changed character. One is a request for new permissions after an update. In the QuickLens case, the harmful version asked for extra rights to alter traffic, which should have triggered a clear browser warning. Another is a change in the developer name or the ownership details shown in the store listing. A browser’s safety check can also help: Google says Chrome’s enhanced protections can warn about untrusted developers and potentially harmful extensions, while Microsoft allows users to report abusive add-ons in Edge.
Removal is simple, but it should be done properly. Chrome users can uninstall an extension from its icon or from the management page. Edge provides the same option from the toolbar or the extensions page, and Microsoft also offers a reporting route for suspicious add-ons. Safari users can remove an extension through Safari settings, and Apple notes that some extensions are tied to an app that may need to be deleted as well. Firefox users can disable or remove extensions through the add-ons manager.
The practical rule is blunt: if you have not used an extension recently, remove it. Every extra add-on widens the attack surface of the browser. If you suspect a malicious extension has been active, removing it is not enough. Passwords should be changed, sessions should be closed on major accounts, and any unusual reappearance of the extension may point to other software on the computer interfering with the browser files. Google advises users in that situation to check for malware or other software altering the extension, which is a reminder that browser compromise can sometimes be a symptom rather than the root problem.
The broader problem is structural. Extensions are useful precisely because they can see and modify web pages, but that same power makes them sensitive. Stores can review what is submitted, yet that does not prevent a legitimate product from being sold on and turned into something harmful later. Until browsers make ownership changes as visible as permission changes, the burden remains on users to keep their extension lists short, grant only minimal access and check them again every few months.
Disclaimer: This content is intended for informational purposes only. Readers are advised to exercise their own judgement, conduct due diligence, or consult a qualified expert before acting on any information provided.
