--- title: The Privacy Risks of Browser Extensions: What Developers... description: Browser extensions can read everything a developer does in the browser, and the fix is restraint in permissions. A 2025 USENIX study of 21 extension developers... canonical: https://daily.dev/posts/the-privacy-risks-of-browser-extensions-what-developers-should-know-o5mz59zy4 twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: The Privacy Risks of Browser Extensions: What Developers Should Know | daily.dev og:description: Browser extensions can read everything a developer does in the browser, and the fix is restraint in permissions. A 2025 USENIX study of 21 extension developers... og:url: https://daily.dev/posts/the-privacy-risks-of-browser-extensions-what-developers-should-know-o5mz59zy4 og:image: https://api.daily.dev/og/posts/o5mZ59zy4.png og:image:alt: The Privacy Risks of Browser Extensions: What Developers Should Know og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # The Privacy Risks of Browser Extensions: What Developers Should Know **[SitePoint](https://daily.dev/sources/sitepoint)** · 6 min read · 2 upvotes · 0 comments ## Summary Browser extensions can read everything a developer does in the browser, and the fix is restraint in permissions. A 2025 USENIX study of 21 extension developers found many recognize the privacy risks but lack resources to address them. Guidance includes starting with zero permissions and adding them one at a time, avoiding broad host access like ``, and bundling code since Manifest V3 restricts remotely hosted scripts. Two recurring risks are ownership changes, as with The Great Suspender, and compromised publisher accounts, as happened to Cyberhaven in December 2024. A VPN protects network traffic but does nothing about an extension reading page content. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What permissions should a Manifest V3 Chrome extension avoid requesting by default? Avoid broad permissions like tabs, cookies, history, and webRequest combined with host_permissions set to , since each one is a privacy decision. History reveals browsing patterns, and cookies paired with all_urls can expose session data on any site. A better approach starts with zero permissions and adds each one only when it can be justified in a short sentence. _Anyone scoping an extension's manifest can track permission guidance like this on daily.dev._ ### Why does Manifest V3 restrict remotely hosted code in Chrome extensions? Manifest V3 restricts remotely hosted code because a script fetched at runtime can change its behavior after the extension passes review, so reviewers can't audit what it will do in the future. Bundling all code into the extension package instead ensures the code that gets reviewed is identical to the code that actually runs. _Developers weighing Manifest V3 migration tradeoffs can follow updates like this on daily.dev._ ### Can a VPN protect against a malicious or compromised browser extension? No, a VPN only protects traffic in transit between the device and the network, it does nothing about an extension that reads page content inside the browser. Extensions can access cookies, page contents, and network requests across every open tab regardless of VPN use, so a VPN never replaces a proper review of extension permissions. _People deciding how to layer browser security tools can track this kind of guidance on daily.dev._ ## Similar posts on daily.dev - [Browser Extensions Are the New Malware Dropper](https://daily.dev/posts/browser-extensions-are-the-new-malware-dropper-8rxy2hs4d) · InfoSec Write-ups · 0 upvotes · 0 comments - [Why browser extensions are a major security risk and what you can do about it](https://daily.dev/posts/why-browser-extensions-are-a-major-security-risk-and-what-you-can-do-about-it-uo10mzxal) · Aikido Security · 1 upvotes · 0 comments - [A Browser Extension Risk Guide After the ShadyPanda Campaign](https://daily.dev/posts/a-browser-extension-risk-guide-after-the-shadypanda-campaign-op0egqjnb) · The Hacker News · 0 upvotes · 0 comments - [Newly discovered malicious extensions could be lurking in enterprise browsers](https://daily.dev/posts/newly-discovered-malicious-extensions-could-be-lurking-in-enterprise-browsers-i20gceevx) · CSO Online · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#devtools](https://daily.dev/tags/devtools), [#privacy](https://daily.dev/tags/privacy), [#google-chrome](https://daily.dev/tags/google-chrome) [View this post on daily.dev](https://daily.dev/posts/the-privacy-risks-of-browser-extensions-what-developers-should-know-o5mz59zy4) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"The Privacy Risks of Browser Extensions: What Developers Should Know","url":"https://daily.dev/posts/the-privacy-risks-of-browser-extensions-what-developers-should-know-o5mz59zy4","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/the-privacy-risks-of-browser-extensions-what-developers-should-know-o5mz59zy4"},"datePublished":"2026-10-26T16:32:15.660Z","dateModified":"2026-10-26T16:32:47.648Z","description":"Browser extensions can read everything a developer does in the browser, and the fix is restraint in permissions. A 2025 USENIX study of 21 extension developers...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/b6ae0959a1399990dca5c9cb56560c6c?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/b6ae0959a1399990dca5c9cb56560c6c?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"SitePoint","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"SitePoint","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/sitepoint","url":"https://daily.dev/sources/sitepoint"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/the-privacy-risks-of-browser-extensions-what-developers-should-know-o5mz59zy4","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":2},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,devtools,privacy,google-chrome","timeRequired":"PT6M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"SitePoint","item":"https://daily.dev/sources/sitepoint"},{"@type":"ListItem","position":3,"name":"The Privacy Risks of Browser Extensions: What Developers Should Know"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/the-privacy-risks-of-browser-extensions-what-developers-should-know-o5mz59zy4#faq","mainEntity":[{"@type":"Question","name":"What permissions should a Manifest V3 Chrome extension avoid requesting by default?","acceptedAnswer":{"@type":"Answer","text":"Avoid broad permissions like tabs, cookies, history, and webRequest combined with host_permissions set to \u003call_urls\u003e, since each one is a privacy decision. History reveals browsing patterns, and cookies paired with all_urls can expose session data on any site. A better approach starts with zero permissions and adds each one only when it can be justified in a short sentence. Anyone scoping an extension's manifest can track permission guidance like this on daily.dev."}},{"@type":"Question","name":"Why does Manifest V3 restrict remotely hosted code in Chrome extensions?","acceptedAnswer":{"@type":"Answer","text":"Manifest V3 restricts remotely hosted code because a script fetched at runtime can change its behavior after the extension passes review, so reviewers can't audit what it will do in the future. Bundling all code into the extension package instead ensures the code that gets reviewed is identical to the code that actually runs. Developers weighing Manifest V3 migration tradeoffs can follow updates like this on daily.dev."}},{"@type":"Question","name":"Can a VPN protect against a malicious or compromised browser extension?","acceptedAnswer":{"@type":"Answer","text":"No, a VPN only protects traffic in transit between the device and the network, it does nothing about an extension that reads page content inside the browser. Extensions can access cookies, page contents, and network requests across every open tab regardless of VPN use, so a VPN never replaces a proper review of extension permissions. People deciding how to layer browser security tools can track this kind of guidance on daily.dev."}}]} ```