According to a recent analysis of 100 extensions done by Cybernews researchers, Chrome extensions have the most invasive permissions and can access even your paint apps, AI sidebars, browsing, QR code generators, and even crypto-related connections. Most of the security experts warn that Chrome users shouldn't use these Chrome extensions because they see everything we do online, so it's better to delete them. The researchers found that 86 out of 100 extensions that were analyzed requested dangerous permissions, and only one extension asked for no permission, which could be considered risky.
It was found that most of the extensions request full access to every website a user visits as well as the ability to run scripts. Some extensions also ask to store and collect user data, as well as request permission to read and change browser tabs, URLs, and content. Some of the extensions even ask permission to check downloads and history of users, and tamper with traffic by injecting ads or redirecting users somewhere else. On average, each extension was found to be requesting 6.4 permissions, with 5.3 of the permissions being moderate to high risk. These extensions do not give the user full control, so the user has to either accept all permissions or not install the extension at all.
There were many inconsistencies found as well in Chrome extensions. There were two QR code generators with the same name and function, but they were asking for different permissions: one to access all websites and the other to inject scripts and store data. Some of the extensions needed minimal permissions for AI tools and writing aids, while other extensions needed extensive access. One of the screenshot tools even asked for access to downloads and all open tabs.
Out of 100 Chrome extensions, 17 asked for 10 or more permissions, with Tampermonkey topping the list with 18 permissions. 7 of those permissions were high-risk, and 7 were medium-risk and the extension is used by advanced users to run scripts and modify websites. Most of the AI and productivity tools were the most permission-heavy, with "AI New Tab Calendar, Tasks, ChatGPT", and "CheckerPlus for Gmail", asking for 16 permissions. 14 permissions were requested by Adobe Acrobat PDF Edit, Magical AI Agent, and Awesome Screen Recorder Screenshot. 46 extensions asked for 5 to 9 permissions, while only five of the extensions required zero to one permissions (full list at the end of this article).
95 out of 100 extensions asked for storage permissions, 65 asked for scripting, 60 asked for hosting access, and 53 asked permission to see and modify tabs. 43 of the extensions also asked to access context menus, 39 asked to access alarms, 22 asked for access to notifications, while 35 asked for storage to store large amounts of data. While this research was being conducted, two of the extensions were removed by Google, called Nimble Capture and refoorest. Google flagged these extensions for potential malicious behavior.
What are the most permission-hungry Chrome extensions found in the analysis?
H/T: Ernestas Naprys.
Read next:
• Cryptocurrency Loss Increased while the Number of Bitcoin Millionaire Addresses Decreased in Q1 2025
• Emotional Needs Drive AI Use, Leaving Marketing Tasks Far Behind
It was found that most of the extensions request full access to every website a user visits as well as the ability to run scripts. Some extensions also ask to store and collect user data, as well as request permission to read and change browser tabs, URLs, and content. Some of the extensions even ask permission to check downloads and history of users, and tamper with traffic by injecting ads or redirecting users somewhere else. On average, each extension was found to be requesting 6.4 permissions, with 5.3 of the permissions being moderate to high risk. These extensions do not give the user full control, so the user has to either accept all permissions or not install the extension at all.
There were many inconsistencies found as well in Chrome extensions. There were two QR code generators with the same name and function, but they were asking for different permissions: one to access all websites and the other to inject scripts and store data. Some of the extensions needed minimal permissions for AI tools and writing aids, while other extensions needed extensive access. One of the screenshot tools even asked for access to downloads and all open tabs.
Out of 100 Chrome extensions, 17 asked for 10 or more permissions, with Tampermonkey topping the list with 18 permissions. 7 of those permissions were high-risk, and 7 were medium-risk and the extension is used by advanced users to run scripts and modify websites. Most of the AI and productivity tools were the most permission-heavy, with "AI New Tab Calendar, Tasks, ChatGPT", and "CheckerPlus for Gmail", asking for 16 permissions. 14 permissions were requested by Adobe Acrobat PDF Edit, Magical AI Agent, and Awesome Screen Recorder Screenshot. 46 extensions asked for 5 to 9 permissions, while only five of the extensions required zero to one permissions (full list at the end of this article).
95 out of 100 extensions asked for storage permissions, 65 asked for scripting, 60 asked for hosting access, and 53 asked permission to see and modify tabs. 43 of the extensions also asked to access context menus, 39 asked to access alarms, 22 asked for access to notifications, while 35 asked for storage to store large amounts of data. While this research was being conducted, two of the extensions were removed by Google, called Nimble Capture and refoorest. Google flagged these extensions for potential malicious behavior.
| Permission | Count |
|---|---|
| storage | 95 |
| scripting | 65 |
| 60 | |
| tabs | 53 |
| contextMenus | 43 |
| alarms | 39 |
| activeTab | 36 |
| unlimitedStorage | 35 |
| offscreen | 27 |
| cookies | 25 |
| notifications | 22 |
| webRequest | 20 |
| webNavigation | 16 |
| declarativeNetRequest | 10 |
| downloads | 9 |
| clipboardWrite | 9 |
| declarativeNetRequestWithHostAccess | 8 |
| identity | 8 |
| idle | 8 |
| bookmarks | 7 |
| history | 6 |
| clipboardRead | 6 |
| tabCapture | 5 |
| topSites | 5 |
What are the most permission-hungry Chrome extensions found in the analysis?
H/T: Ernestas Naprys.
Read next:
• Cryptocurrency Loss Increased while the Number of Bitcoin Millionaire Addresses Decreased in Q1 2025
• Emotional Needs Drive AI Use, Leaving Marketing Tasks Far Behind
