Malicious browser extensions: risks and how to review or remove them

Malicious browser extensions are add-ons that look useful (a coupon finder, PDF converter or ad blocker, say) but collect data, change settings or inject ads once installed. Because extensions run inside the web browser, a harmful one can see much of what happens there. This guide explains how extensions work, what the risks are, the questions browser makers suggest asking before installing one, and how to review and remove extensions in Chrome, Microsoft Edge, Safari and Firefox, based on each maker’s own help pages.

How browser extensions work

An extension is a small program that adds features to a browser. To work, it asks for permissions: access to things such as the pages being viewed, browsing history, downloads or the clipboard. Chrome describes one common permission as the ability to “read and change site data”. An extension with that permission on all sites can, in principle, see and alter what appears on every page, including sign-in forms and web email.

Most extensions come from the browser’s official store (the Chrome Web Store, Microsoft Edge Add-ons, the Mac App Store for Safari, or addons.mozilla.org for Firefox). Apple says: “All extensions in the App Store are reviewed, signed, and hosted by Apple for your security.” Mozilla says extensions on its add-ons site are “scanned for a set of common issues” and may get human review, but that neither process guarantees an extension is completely safe.

What can go wrong

• Data collection. An extension with broad permissions can collect browsing activity or page content.
• Settings hijacking. Google’s help explains that extensions can change the homepage, new tab page, search engine or start page. When that happens, Chrome’s settings show a notice that the extension “is controlling this setting”.
• Fake “managed by your organisation” extensions. Microsoft warns that extensions claiming to be managed by an organisation “can sometimes be malware”, and describes running a full scan if one appears on a personal computer.
• Fake updates and downloads. ASD’s information stealer advisory lists fake browser updates, malicious ads and malicious search results among the ways infostealer malware is delivered. It notes that passwords saved in browsers, cookies and autofill data are common targets. See malware and spyware explained.
• Ownership changes. An extension that was fine when installed can change after an update or a new developer takes over, which is one reason periodic review helps. The monthly security habits checklist is one way to build that in.

A fictional example

Mei installs a free “shopping helper” extension from a link on deals.example. It asks to read and change data on all websites, and she clicks through. A few days later her search engine has changed and she sees extra ads on every page. In Chrome’s settings, a notice says the shopping helper is controlling her search engine. Google’s help explains that removing the extension returns the settings to how they were.

How to check an extension before installing it

Google’s help says: “Make sure that you only approve extensions that you trust.” Microsoft’s Edge guide describes reviewing the permissions listed in the prompt before selecting Add extension. Mozilla’s tips for assessing an extension include:

• Do the permissions match the features? A location request should match a feature that needs location.
• Is each permission explained on the listing or the developer’s site?
• How many people use it, and what do reviews say? With few reviews, Mozilla suggests looking more closely at permissions and the developer.
• Is the developer known and trusted? Many extensions come from individual developers who aren’t well known, so Mozilla suggests checking that their website or social media matches the extension.
• Is there a privacy policy? Mozilla suggests deciding whether its data handling is acceptable.
• Where did it come from? For extensions from outside the official site, Mozilla suggests checking the source is authentic.

Google adds that with enhanced protection turned on, Chrome warns: “This extension is not trusted by Enhanced Safe Browsing.”

How to review and remove extensions

The steps below are based on each maker’s instructions, checked October 2026. Menus can change between versions; each maker’s linked guide has the latest steps.

Google Chrome

Based on Google’s Chrome Help:

1. Select More (three dots), then Extensions > Manage extensions.
2. Review the list. Use the on/off setting to turn an extension off, or select Details to see its permissions and site access. In Details, the site access setting can be changed to On select, On specific sites or On all sites.
3. Or, from the toolbar, select Extensions, then More next to the extension, point to This can read and change site data, and choose When you select the extension, the current site, or On all sites.
4. To remove one, open it in Manage extensions, select Remove, then Remove again to confirm. If its icon is beside the address bar, right-click it and choose Remove from Chrome.

Microsoft Edge

Based on Microsoft’s Edge guide:

1. Select Extensions to the right of the address bar (or, if it isn’t there, Settings and more > Extensions), then Manage extensions.
2. Switch an extension’s toggle off to turn it off.
3. To remove one, select More actions next to it, then Remove from Microsoft Edge > Remove. Or right-click (or press and hold) its icon beside the address bar and choose Remove from Microsoft Edge.

Microsoft describes reporting an extension, including for malware, by signing in to the Microsoft Edge Add-ons website, selecting the extension, then Report abuse.

Safari on Mac

Based on Apple’s Safari extensions guide:

1. In Safari, choose Safari > Settings (or Preferences), then click Extensions.
2. To turn one off, deselect its checkbox.
3. To remove one, select it and click Uninstall.
4. Click Edit Websites to allow, deny or ask before an extension gets access to particular websites.

Apple notes that uninstalling an extension on one device doesn’t remove it from others (it has to be uninstalled on each device), and that on macOS Sonoma 14 or later, extensions needing website access are off by default in private windows unless Allow in Private Browsing is chosen. This guide covers browsers on computers; Apple’s iPhone and iPad User Guides cover Safari extensions on those devices.

Firefox

Based on Mozilla’s Firefox guide:

1. Click the menu button, then Add-ons and themes, then Extensions.
2. Use the toggle to disable an extension (it stays installed).
3. To remove one, click its three-dot menu and select Remove.

Mozilla has separate articles for extensions that changed the new tab page or home page, and for add-ons that can’t be removed.

If an extension won’t go away or may be malware

An extension that keeps reinstalling itself, can’t be removed, or claims to be “managed by your organisation” on a personal computer may be a sign of other malware. Microsoft describes running a full scan with Microsoft Defender or another reputable antivirus program. Google says that if an extension stays corrupted after a repair, a suspicious program may be changing its files, and describes running antivirus or anti-malware software. ASD’s recovery steps include disconnecting the device from networks and other devices, running a full device scan, and not entering passwords on an infected device; when changing passwords, ASD says to make sure the device used is clean of malware. See Windows computer security basics and Mac security basics.

Things to watch for

• Broad permissions for simple tasks. A calculator doesn’t obviously need to read every website.
• Install prompts from ads or pop-ups. ASD lists malicious ads and fake browser updates as delivery routes.
• Sudden changes to the search engine, homepage or new tab page.
• Extensions nobody remembers installing.
• “Managed by your organisation” on a personal browser, which Microsoft says can sometimes be malware.
• Extensions on work devices. Google notes that work or school computers may block some extensions; workplace IT policies apply there.

Common questions

How can I tell if a browser extension is malicious?

There’s no single test, but browser makers describe several checks. Mozilla’s tips include whether the permissions match the features, what reviews say, whether the developer is known, and whether there’s a privacy policy. Sudden changes to the search engine or homepage are another sign, and Chrome shows when an extension “is controlling this setting”. See how to check an extension before installing it.

Are browser extensions safe?

Many are useful, but browser makers don’t describe them as risk-free. Mozilla says scanning and review on its add-ons site don’t guarantee an extension is completely safe, and Google’s help says to only approve extensions you trust. An extension that can “read and change site data” on all sites can, in principle, see sign-in forms and web email. See how browser extensions work.

How do I remove an extension in Chrome?

Google’s steps are More > Extensions > Manage extensions, then open the extension, select Remove and confirm. If its icon is beside the address bar, you can right-click it and choose Remove from Chrome. Edge, Safari and Firefox have similar options, and each maker’s help page has the latest steps. See how to review and remove extensions.

Why did an extension change my search engine?

Google explains that extensions can change settings such as the search engine, homepage, new tab page or start page. When that happens, Chrome’s settings show a notice that the extension “is controlling this setting”. Google says: “When you remove the extension your settings will go back to how they were before you installed it.” See what can go wrong.

Why does my browser say an extension is managed by my organisation?

On a work computer it may be set by an administrator. On a personal computer, Microsoft warns that extensions claiming to be managed by an organisation “can sometimes be malware”, and describes running a full scan with Microsoft Defender or another reputable antivirus program. See if an extension won’t go away or may be malware.

What do I do if an extension won’t go away?

An extension that keeps reinstalling itself or can’t be removed may be a sign of other malware. Microsoft and Google both describe running antivirus or anti-malware software. ASD’s recovery steps include disconnecting the device from networks, running a full device scan, and not entering passwords on an infected device. See if an extension won’t go away.

Where to get official help

• Google Chrome Help: install and manage extensions.
• Microsoft Support: add, turn off or remove Edge extensions.
• Apple Support: use Safari extensions on a Mac.
• Browser settings beyond extensions: browser privacy and security.
• ASD’s ACSC: recover from malware and the 24/7 hotline 1300 CYBER1 (1300 292 371).