An extension with permission to read and change data on all sites can see everything the browser sees: the pages, the forms, the session that keeps you logged in. Why that permission is so commonly granted, what it actually permits, and how the risk arrives long after installation.
The permission nobody reads
Read and change all your data on the websites you visit. It is the broadest permission available on a personal machine, and it is granted routinely, in a second, in exchange for a convenience like a colour picker.
It covers page content, including pages only you can see. It covers form fields as they are filled, which includes passwords at the moment of typing and at the moment of autofill. And it covers the cookies that constitute being logged in — not the password, but the thing the password was exchanged for, which is what an attacker actually wants.
Why it is more privileged than an app
An ordinary application is sandboxed away from your browsing. To reach what you see in a browser, it has to break something.
An extension has nothing to break. It runs inside the session, after authentication and after decryption, reading the page as rendered. Transport encryption protected that data from the network; it was never intended to protect it from software the user invited into the page.
This is why extension risk is not comparable to ordinary application risk. The security model was satisfied before the extension ever looked.
The risk arrives later
Almost nothing malicious is installed as such. The usual sequence is that a genuinely useful extension is written, acquires users, and then changes — sold to somebody who wanted the install base, or compromised through the developer's account, or updated to add analytics that grow over successive releases.
You installed one thing and now run another. Updates are automatic and silent by design, which is correct for security patches and is the same channel by which this arrives.
That makes it a supply chain problem rather than a decision you made at install time — and supply chain problems are not solved by being careful at the moment of choosing.
What the reviews cannot tell you
Store review happens before the update that matters, and the review that would catch this is the one nobody performs on version fourteen.
Ratings measure usefulness. A tool can be excellent and exfiltrating, and users would rate the excellence.
And the permission list is identical for the benign and the malicious version, because the permission is precisely what enables both. Nothing in the interface changes when the behaviour does.
Practical reduction
Fewer extensions, and fewer that ask for everything. This is dull and it is the whole control.
Prefer ones scoped to specific sites over ones scoped to all sites, where that option exists — many more tools work this way than are configured to.
Review what is installed every few months and remove what you no longer use. Dormant extensions are where this risk concentrates: still permitted, still updating, no longer noticed by anybody.
And keep a separate browser profile with no extensions at all for banking and anything else where the live session is the prize. It costs one extra window.
The general shape
Wherever automatic updates meet broad permissions, what you audited is not what will be running. The same shape appears in system packages, in mobile applications, in dependencies pulled into software at build time, and in anything installed once and trusted thereafter.
Consent was a single event. Execution is continuous. The gap between those two is where this class of problem lives, and it does not close by choosing more carefully on the day.
Close
Assume that anything holding broad permission will eventually be something other than what you installed, and grant accordingly. Not because developers are dishonest — most are not — but because the install base itself is the asset, and assets get sold.