Chrome Extension

A browser is the program used to open web pages – for example, Chrome from Google. A Chrome Extension is a small add-on program that gets installed into this browser. Afterward, the browser can do something it couldn’t do before. Typical examples are ad blockers, password managers, or translation aids. Such an extension is installed with just a few clicks, usually from Google’s official Chrome Web Store. You can think of it like an app on a phone, except it doesn’t sit on the home screen but inside the browser.

Why extensions have so much power over the browser

For most people, the browser is the single most important program of all. It’s where the school cloud, online banking, email, and social networks all run. An extension sits exactly within this layer. It potentially sees everything that appears on a web page – including passwords or account balances.

This makes extensions powerful and, at the same time, risky. There have been repeated cases in which popular extensions were sold to new owners. Afterward, an update would secretly push in malicious code that collected users' browsing behavior. Nothing was visible to users, because the extension kept working as usual.

For companies, this is a serious security issue. Many firms therefore only allow a vetted list of extensions. Economically, extensions are also interesting because AI companies can reach users directly through them – without the user having to install their own app.

What an extension is technically allowed to do

At its core, a Chrome Extension consists of the same building blocks as a web page: HTML for structure, CSS for appearance, and JavaScript for logic. JavaScript is a programming language that runs directly in the browser. On top of that comes a text file called the manifest. It states the extension’s name, what it does, and which permissions it requires.

These rights are called permissions. An extension must, for example, explicitly request permission to read the content of all visited pages. When installing, Chrome displays this request as a warning notice. Many users click past the notice without reading it – and that’s exactly where the problem lies.

A so-called content script is injected into the opened web page and can alter its content. This is how an ad blocker hides ads. A background process runs alongside it and reacts to events, such as a click in the menu. Since the switch to the rule version Manifest V3, Google has significantly restricted the capabilities of these background processes. This was meant to increase security, but above all it weakened ad blockers and drew a lot of criticism.

Chrome Extensions as a gateway for AI tools

In everyday life, one encounters extensions constantly without using the term. Grammar checkers like Grammarly, ad blockers like uBlock Origin, or password managers like Bitwarden are all extensions. They typically show up as a small icon at the top right next to the address bar.

In tech news, extensions currently appear mainly in connection with AI. Providers of language models supply extensions that generate a summary on any web page or rewrite text. Some go further and control the browser itself: they fill out forms or click their way through an order. Such tools are called browser agents.

A common misconception is that everything in Google’s Chrome Web Store has been vetted and is therefore safe. Google runs automated checks, but they by no means catch every instance of abuse. It’s therefore wise to: install few extensions, delete ones no longer used, and pause to think whenever a permission request appears. Incidentally, the same principle exists for Firefox, Edge, or Safari under different names.