How to Audit Browser Extension Permissions

Reviewed by Cybersecurity Editorial Team · Updated Sep 2026

If you’ve ever wondered how to audit browser extension permissions, a recent incident makes the case better than any warning could. ModHeader, a browser extension used by 1.6 million people, was pulled from the Chrome Web Store and Microsoft Edge Add-ons store after a researcher found a dormant data collector hiding inside its code, according to The Hacker News’ original report on ModHeader.

Most coverage of stories like this stops at “the extension got removed.” That’s useful, but it doesn’t help with the extension already sitting in your browser. This guide skips the recap and gives you a repeatable, 10-minute way to check what your installed extensions can actually do: not just what they claim to do.

You don’t need to be a developer for this. Just ten minutes, a few browser menus, and a habit of checking back periodically.

What happened with ModHeader ?

ModHeader is a widely used browser extension that lets developers and testers modify HTTP request and response headers, a common, legitimate task in web development and QA work. It had built up 1.6 million installs across Chrome and Edge, according to The Hacker News.

According to that same report, a security researcher analyzing the extension’s code discovered a data-collection capability built into it that wasn’t actively running at the time and described as “dormant.” In plain terms: the ability to collect data appeared to exist in the code, but it wasn’t confirmed to be actively pulling information from users when it was found.

Following the discovery, both Google and Microsoft removed ModHeader from their respective stores, as reported by The Hacker News. Some details remain unclear as of this writing: the exact type of data the dormant code was built to collect, what would have triggered it, whether any data collection actually happened before discovery, and how the code ended up in the extension in the first place. Those specifics haven’t been independently confirmed in available reporting, so we won’t speculate on them here.

Why “dormant” collectors are so hard to catch

Fair question: how does something like this slip past app store reviews and years of good ratings? The short answer is that store vetting and user reviews mostly judge whether an extension works as advertised and not whether every line of its code could, under the right conditions, do something else entirely.

A “dormant” capability is code that exists but stays inactive, sometimes for a long time, until something specific triggers it such as a date, a remote signal, a version update, or some other condition. Automated scans and casual code reviews are built to catch obviously malicious behavior happening right now. They’re much less effective at catching capability that’s present but switched off.

That’s exactly the gap the ModHeader case demonstrates, based on The Hacker News’ reporting: it took a researcher manually digging into the extension’s code and not an automated store scan, to surface the issue. That’s a meaningful distinction. It tells us “reviewed by the store” isn’t a reliable enough signal on its own.

Why store ratings and reviews aren’t enough

Here’s the core problem: popularity and star ratings measure whether an extension is useful, not whether it’s safe. ModHeader had 1.6 million installs and had presumably been reviewed and rated by real users for a long time before the dormant collector was found, according to The Hacker News’ reporting. None of that popularity caught the issue.

This matters because most people, understandably, treat “lots of installs, good reviews, still in the store” as a proxy for trustworthy. The ModHeader case shows that proxy can fail quietly, for a long time, with no visible sign to the average user.

The good news: you don’t have to rely on the store’s vetting alone. Browsers expose what permissions each extension has requested, and you can check that yourself.

Your 10-minute browser extension audit

This is a simple routine you can run on any device, in any browser, in about ten minutes. Do it now, then repeat it every few months.

1. List every installed extension, in every browser you use. Most people have extensions in more than one browser (say, Chrome on a work laptop and Edge on a personal one) and forget about the ones they don’t open often.
2. Review each extension’s requested permissions. Every extension declares what it can access such as specific websites, all websites, browsing history, clipboard, downloads, and so on. Look at each one.
3. Check the publisher/developer identity and update history. Is it the original developer, or has ownership changed? When was it last updated, and does the update history look active and legitimate?
4. Search the extension’s name plus “security” or “malware.” A quick search takes thirty seconds and can surface reports, warnings, or news coverage you’d otherwise miss.
5. Compare permissions to the extension’s actual job. A header-modifying tool, a note-taking tool, or a simple ad blocker rarely needs access to everything you type or every site you visit. If the permissions look bigger than the job, that’s worth questioning.
6. Remove or disable anything you don’t recognize, don’t use, or can’t justify. If in doubt, take it out, you can always reinstall a legitimate tool later if you decide you need it.

Checking permissions in Chrome, Edge, and Firefox

Chrome: Go to the three-dot menu > Extensions > Manage Extensions (or type chrome://extensions in the address bar). Click “Details” under any extension to see its site access settings and permissions. Google’s own guide to Chrome extension permissions breaks down what each warning actually means.

Microsoft Edge: Go to the three-dot menu > Extensions > Manage Extensions (or type edge://extensions in the address bar). Click on an extension name to view its permissions and site access.

Firefox: Go to the menu button > Add-ons and Themes > Extensions. Click the three-dot icon next to an extension and choose “Manage,” then check the “Permissions” tab.

In all three browsers, look specifically for “read and change all your data on all websites” or similarly broad wording which means that’s the browser telling you an extension has very wide-reaching access.

Red flags that suggest an extension deserves a closer look

• Access to all websites, when the extension’s actual job only needs one site or a narrow set of sites
• A recent change in ownership or developer name, especially for an extension you installed a long time ago
• A vague or missing privacy policy that doesn’t clearly explain what data is collected and why
• Permission requests unrelated to the extension’s core function For example, a simple utility asking for clipboard or browsing history access
• A sudden jump in requested permissions after an update, with no explanation of why the extension now needs more access than before

What small-business IT teams should do differently

For an individual, a personal audit every few months is a solid habit. For a small business, extensions installed across multiple employee browsers create a bigger, harder-to-track risk and one risky extension can potentially touch company data on every machine it’s installed on.

A few practical steps for small business IT teams:

• Maintain an approved extension allowlist. Decide which extensions are actually needed for work, document them, and treat anything outside that list as unapproved by default.
• Run periodic audits across all company devices, not just once at setup. Extensions and their permissions can change after the initial install, through updates.
• Use browser management policies Such as Chrome Enterprise policies or Microsoft Edge management policies, to control which extensions employees can install, and to block installs from outside approved sources.
• Assign someone ownership of this check. An audit that’s “everyone’s job” quietly becomes nobody’s job. Put it on a calendar with a named owner.

For understand emerging cyber threats, see our section on threat insights.

Extensions are small pieces of software with real access to your browsing life, and the ModHeader incident shows that even popular, long-trusted ones can carry capabilities nobody outside the code ever sees. You now have a concrete, ten-minute method to check your own setup , permissions, publisher identity, and a quick search rather than relying on store ratings alone. Make it a recurring habit, and share it with anyone on your team who installs their own tools.

Frequently Asked Questions

Sources: The Hacker News, Google Chrome Extension Permissions Documentation. Last updated July 2026.