An extension with permission to read all sites can see every form you fill in. A five-minute audit finds the one that should not be there.
Open the extensions page of every browser you use, read the **permission line** under each entry and remove anything you cannot name a use for. An extension that changes owner keeps its old permissions.
Each browser has its own extension store and its own settings page. A second browser you rarely open still runs whatever was installed there two years ago.
chrome://extensions
edge://extensions
about:addonsThe line under each entry states what the extension may do. **Read and change all your data on all websites** is full access to every page, including login forms and bank statements.
Open the extension's details page and look at the developer and the update date. A tool that changed hands and pushed an update a week later is a classic pattern for injected ads or tracked links.
Disabling keeps the extension installed and updating. Remove what you have not used in a month; you can reinstall it from the store in seconds if you miss it.
For the ones you keep, set site access to **On click** or to specific sites. That keeps the function and removes the silent access to everything else.
Extension details > Site access > On clickRepeat the audit every few months and after installing anything that offers a browser add-on. The list only grows when nobody looks at it.
An installed program or an enterprise policy reinstalls it. Check chrome://policy and the installed applications list.
The extension is managed by policy. Only the administrator account or the policy source can remove it.
Clear the cache and restart. Removed extensions leave profile data behind, not a performance penalty.
Change the passwords it could read, starting with email and banking, and check the account for active sessions.
No, but the permission scope decides how much damage a bad update can do. A narrow permission on a trusted tool is a small risk.
Only if the extension is not allowed in incognito. Most are off there by default, and the ones you enable are exactly the ones to watch.
Reinstall anything you removed from the official store. Site access settings can be set back to **On all sites** per extension, which reverts the tightening.
Free · no account needed · tracks your progress