An extension takes about ten seconds to install. You click Add, a box appears asking for permissions, you click Add again because you want the thing to work, and that is the last decision anyone ever makes about it.
Multiply that by every person in the office and every browser they use, and you have a list of small programmes with deep access to your work that nobody has reviewed, nobody maintains, and nobody can name.
This is not an argument against extensions. Password managers, ad blockers, accessibility tools and single sign-on helpers all earn their place. It is an argument for knowing what is installed and what it can see.
What you actually agreed to
The permission box is doing real work, and it is worth reading once so you know what the phrasing means.
Google’s own guidance warns that some extensions need permission to “read and change site data”, and that the broadest version of that is read and change all your data on websites you visit. Its advice is one sentence long: “Make sure you only approve extensions that you trust.”
Take that permission literally. An extension holding it can see the invoice you are editing, the client record on screen, the contents of a webmail session, and anything typed into a form. It is not looking over your shoulder. It is inside the page.
The useful part is that it is adjustable. Chrome lets you change an extension’s permissions at any time through the Details panel for that extension, including restricting it to specific sites instead of all of them. Most tools that genuinely need site access only need it on one or two sites.
The four risks that matter
Permission creep. The extension that only formatted dates when you installed it now wants access to everything. Updates can widen what an extension asks for, and most people click through the prompt.
A change of owner. A useful extension with a decent user base is an asset, and small ones get bought. The code that ships tomorrow is not necessarily written by the person whose reputation convinced you to install it. Nothing visible changes in your browser when that happens.
Abandonment. An extension that has not been updated in years still runs with the access you granted it. Nobody is fixing its flaws, and the person who wrote it may have moved on entirely.
Sheer weight. Enough extensions and the browser gets slow, crashes, or behaves oddly in ways that are hard to attribute. We had a machine come through the service desk that had simply hit the maximum number of extensions the browser would allow.
What changed in Chrome, and why you should care
The engine underneath Chrome extensions changed, and the old one is gone.
Google’s Manifest V2 deprecation timeline records the sequence. Manifest V2 extensions were disabled by default on 31 March 2025, with users still able to switch them back on. With Chrome 138, from 24 July 2025, “all users on all channels of Chrome have now Manifest V2 extensions disabled”. The enterprise policy that let organisations delay this was removed with Chrome 139. By 31 August 2026, “all remaining Manifest V2 extensions have been removed from the Chrome Web Store”.
Two practical consequences. First, if something in your browser quietly stopped working over the last year, this may be why, and the fix is finding a maintained replacement rather than trying to re-enable it. Second, an extension whose developer never made the move is not coming back. It is an abandoned tool with a dead listing, and it should come off the machine.
What the Essential Eight asks of you
Australian businesses have a clear benchmark here, and browser extensions are named in it specifically.
At Maturity Level One of the Essential Eight maturity model, the Australian Signals Directorate requires that a vulnerability scanner is used at least weekly to find missing patches in “office productivity suites, web browsers and their extensions, email clients, PDF software, and security products”, and that patches for those are applied within two weeks of release. The same level requires that browsers and their extensions “that are no longer supported by vendors are removed”.
Under user application hardening, ASD also requires that web browser security settings cannot be changed by users. That is the control most small businesses have never switched on.
So the baseline is not “be careful what you install”. It is: know what is installed, keep it patched within a fortnight, remove anything unmaintained, and stop the settings being changed by whoever is sitting at the machine.
What one person can do this week
- Open your browser’s extensions page and read the whole list out loud. Anything you cannot explain, remove.
- For each survivor, open Details and check what site access it has. Move it from all sites to specific sites wherever the tool still works that way.
- Check when each was last updated. Anything that has gone quiet for a long stretch is a candidate for replacement.
- Install from the official store for your browser, and not from a link in an email or a pop-up offering to fix something.
- Do the same on the browsers you forget about, the second one you keep for one stubborn website, and the one on the shared reception machine.
What a business should do instead
Relying on every staff member to make good decisions in a permission dialogue is not a control, it is a hope.
Chrome Enterprise lets an organisation manage this centrally: allow or block extensions by ID, block extensions based on the permissions they request, and force-install the ones people actually need. Microsoft Edge has equivalent controls. Configured properly, the password manager arrives automatically on every machine and everything else needs a decision by someone who is paid to make it.
The block-by-permission option is the one worth understanding. Rather than chasing individual extensions, you can decline the whole category that asks to read and change data on every site, then allow the handful that genuinely need it. That scales, and it keeps working when a new extension appears next month.
In the twelve months to 18 August 2026 our service desk saw only six browser-related tickets across five client businesses. That sounds reassuring, and it is exactly the problem. A badly behaved extension does not raise a ticket. It just reads things.
The one step for today: open your extensions page, count how many are there, and remove everything you cannot justify in a sentence. If you would like the list on your work machines managed properly rather than per person, get in touch.