Quick figures (snapshots)
These callouts cite specific reports or papers—use them as orientation, not a live threat meter.
- 4.3M+
Users cited in a multi-year malicious-extension investigation
Industry reporting summarized a long-running campaign affecting Chrome and Edge users, noting spyware-style behavior alongside hijacking and data collection. Treat the figure as the outlet’s summary of vendor research, not a government census.
- Peer
Academic analysis of cookie theft via extensions
Independent researchers systematically studied how extension architectures enable cookie and session abuse; useful background even when your immediate worry is page tampering, not cookies alone.
What this access enables
- Inject or run scripts in matching pages (often combined with scripting APIs) to read DOM text, alter layout, or attach listeners to keystrokes where the design allows.
- Combine with cookie, storage, or network APIs (when also declared) to exfiltrate session state or rewrite requests—host access is the “foot in the door” for many follow-on actions.
- Operate continuously in the background on new tabs without asking again each time, unlike single-shot activeTab grants.
If it is abused or compromised
- Credential phishing by swapping login fields or overlaying fake prompts while the address bar still looks familiar.
- Silent data collection: page text, form values, and metadata that ordinary site JavaScript cannot reach the same way.
- Supply-chain upgrades: a benign extension can push an update that turns malicious while permissions stay overly broad.
Evidence, documentation, and reporting
Platform documentation (how the power is granted)
Chrome documents host permissions, content script match patterns, and warning behavior in one place—useful to see which APIs implicitly require broad origins.Sources: Chrome — Declare permissions & host access · Chrome — Match patterns · Chrome — Permission warnings
Programmatic injection and scripting are how many “read/change page data” features are implemented; the API reference spells out execution contexts.Sources: Chrome — scripting API
Secure engineering guidance
Mozilla’s extension security notes stress avoiding remote code, unsafe DOM writes, and accidental bridging between untrusted page scripts and privileged extension code—failure modes that matter when host access is wide.Sources: MDN — Extension security best practices
OWASP material on injection-class bugs helps explain why “small” UI changes on a page can become account takeover when combined with social engineering.Sources: OWASP — Cross-site scripting (XSS)
Investigations, research, and policy context
Newsrooms and vendors regularly document fraudulent extensions that steal sessions or hijack browsing; keep a skeptical eye on install counts versus publisher reputation.Sources: The Register — coverage of large malicious extension campaigns · arXiv:2405.06830 — cookie theft via extensions (related privileged access)
Consumer-protection agencies emphasize data minimization and knowing who receives personal data—relevant when an extension’s stated feature does not justify universal site access.Sources: FTC — Protecting personal information (business guide)
Practical mitigations
- Prefer extensions scoped to explicit sites (or activeTab) when that matches the feature.
- Verify publisher identity, source code transparency, and update history; remove extensions you no longer use.
- Separate high-risk browsing (banking, admin consoles) into a profile or browser install with zero/low extensions.
Frequently asked questions
Concise answers for this permission class—use with the evidence and mitigations above for full context and citations.
Further reading (curated)
Mix of vendor documentation, standards-style guidance, independent research, and news investigations—each page below is a different angle on the same permission class.
- Chrome — Declare permissions & host permissions
- Chrome — scripting API
- Chrome — cookies API
- Chrome — tabs API
- MDN — WebExtensions security best practices
- OWASP — XSS
- Chromium blog — Manifest V3 overview (platform direction)
- NIST — Cybersecurity Framework (overview)
- ENISA — Threat landscape publications
- arXiv:2405.06830 — extension cookie abuse study
- The Register — malicious extension campaign reporting
- FTC — Safeguarding data
Related extension guides
These topics often show up together in real extensions and abuse reporting—reading them as a set makes it easier to judge combined risk.
- Browser extensions & scripts / DOM (full guide)
Content scripts, scripting API, what “read and change all your data” means, cited incidents, and how to reduce scope.
- Browser extensions & network traffic (full guide)
Host permissions, fetch, declarativeNetRequest, redirects, documented abuse at reported scale, and mitigations.
- Browser extensions & cookies (full guide)
Cookie APIs, HttpOnly limits, session theft, MFA, cited figures from reporting and research, and practical mitigations.
- Browser extensions & open tabs (full guide)
How extension tab permissions work (open tabs, URLs, navigation): capabilities, documented incidents with cited user counts, token-in-URL risks, and mitigations.
Audit what is installed
Pair least-privilege installs with a periodic review—especially after any extension update.