We checked the 150 most popular Chrome extensions

Full access is normal. That's the problem.

Most of these extensions need broad access to do their job: an ad blocker, a password manager or a grammar checker can't work without reading the pages you open. We rate all 148 of them as low risk today. They're popular, maintained and have a named developer.

The risk is what happens next. Extensions get sold, and the new owner inherits the users, the reviews and every one of those permissions. Chrome installs the next update silently and never says that someone else is now behind it. In one campaign reported this year, attackers bought established extensions and turned them into password and crypto-wallet stealers.

What else they can do

How many of the 148 extensions ask for each permission.

• Run its own code on pages scripting93
• See the address and title of every tab tabs76
• Watch your network requests webRequest46
• Read and change cookies, including sign-ins cookies40
• See every page you visit, as you visit it webNavigation38
• Sign in with your Google account identity14
• Talk to programs installed on your computer nativeMessaging11
• Read your browsing history history5
• Read your clipboard clipboardRead3
• See and turn off your other extensions management5
• Take full control of pages through the debugger debugger3

Full access, no update in over a year

12 extensions with access to every website, used by 20 million people combined, haven't shipped an update in more than a year. That doesn't make them unsafe, and some are simply finished. But a popular extension that's no longer maintained is exactly what buyers look for.

How we checked

• The list is the 150 extensions with the most users across the Chrome Web Store's categories.
• Developer, user count, last update and trader status come from each public store listing, read on October 30, 2026.
• Permissions come from the manifest of the version currently in the store: required permissions, host permissions and the sites its content scripts run on. Optional permissions an extension may ask for later aren't counted. We couldn't read the package of 2 extensions, so the figures cover 148.
• User counts are the store's rounded numbers. They count installs, not people, so the totals overlap.
• "Not registered as a business" means the developer declared themselves a non-trader in the store. For people in the EU, consumer rights then don't apply to that developer.

Every extension above links to its own page with the full store details. The raw data is available as JSON, free to reuse with a link back.