Browser Extension

A browser is the program you use to open websites — such as Chrome, Firefox, Safari, or Edge. Out of the box, it can essentially do one thing: display pages. A browser extension is a small add-on program that you install afterward, which expands this range of functions. It doesn’t run as its own window on your computer, but rather within the browser and usually directly inside the pages you visit. A fitting comparison is apps on a phone: the basic device can make calls, and you install everything else yourself. Well-known examples are ad blockers, password managers, translation helpers, and, increasingly in recent years, AI assistants.

Why extensions are so powerful — and so risky

The appeal of an extension lies in the fact that it works inside the webpage. A normal program only sees what you give it. An extension, on the other hand, potentially sees every page you open, including text, images, and input fields. That’s exactly why an ad blocker can remove ads before you even notice them. And that’s exactly why an AI assistant can summarize the content of a page without you having to copy anything.

That same closeness, however, makes extensions a security risk. Whoever has access to all pages may, in the worst case, also see your online banking and your emails. Time and again, harmless extensions are sold by their developers. The new owners then secretly build in data collectors or ad code — and the update automatically reaches all users. Security researchers regularly find extensions with hundreds of thousands of installations that resell browsing histories.

Economically, extensions are also a battleground. Ad blockers cost the advertising industry billions, which is why Google faced heavy criticism when switching to the new extension interface Manifest V3: it restricts precisely the technology that blockers use to work especially thoroughly. Google justifies the move with security concerns, while critics see a conflict of interest at the world’s largest advertising company.

What happens technically during installation

An extension usually consists of the same building blocks as a website: HTML for structure, CSS for appearance, and JavaScript as the programming language. On top of that comes a text file called the manifest. It states what the extension does, which files belong to it, and which permissions it requires. Permissions are things like “may read all websites” or “may see browsing history.” The browser shows you these before installation.

After installation, the extension injects its code into every matching page. A translator waits there until you highlight text. An ad blocker compares every requested address against a long filter list and blocks matches. In addition, a script runs in the background that stays active even when you don’t have a page open. Everything together is published as a package in a store, such as the Chrome Web Store or Mozilla’s Add-ons.

AI assistants in the sidebar

Extensions are currently most visible in the field of artificial intelligence. Providers like OpenAI, Perplexity, or Grammarly ship extensions that open a sidebar in the browser. You highlight a paragraph, click, and get a summary or translation. Technically, the extension sends the text to a server run by the provider and displays its response. This is convenient, but it means that foreign content leaves your device.

A newer variant is so-called agent extensions. They’re meant not just to answer, but to click, fill out forms, and complete orders themselves. This shifts the risk: a mistake is then no longer a wrong answer, but a wrong booking. Experts warn about prompt injection — where someone hides an instruction on a webpage that the AI mistakenly interprets as a command.

For everyday use, a few simple rules therefore apply. Install few extensions and remove unused ones again. Before clicking, check who the provider is and which permissions are being requested. And be suspicious if a simple tool wants access to all websites.