Extension

What are extensions?

A browser extension (usually just “extension”) is a mini-app that can be downloaded and added to a Web browser to augment it’s out-of-the-box functionality or to add a new feature. Common browser extensions include ad blockers, spell-checkers, dark-mode / visual altering tools, and crypto wallets. Extensions are usually made by third parties (i.e. not the browser), and not always policed or vetted for security / privacy risks.

Where do you get extensions?

Each browser developer maintains an online listing of available extensions, similar to an app store. Developers who create extensions will post them in these listings. Somewhere in a browser’s menus, there will be a way to open the extension store.

Chrome, Brave, and Edge can all use the same extensions. However, Safari extensions only work with Safari, and Firefox extensions only work with Firefox.

What can extensions do?

The full range of what extensions can do depends on the browser. Some browsers allow more flexible and powerful extensions than others.

Extensions can have full control over the contents of webpages. They can change a page’s appearance, add or remove parts of it, analyze text, automatically fill in forms, and so on. In short, they can do anything you can, and more.

One popular category of extensions is ad blockers, which prevent ads from showing up. A similar but more general category is tracker blockers, which prevent trackers from tracking your activity across websites. Since most ads include tracking functionality, tracker blockers block most ads as a side effect.

There are many other popular extension categories:

• Extensions that store information like passwords and credit cards numbers, and automatically fill in forms that require them.
• Extensions that help you keep your tabs organized.
• Extensions that provide writing assistance like spell-checking, grammar-checking, or language translation.
• Extensions that alter the appearance of pages, such as changing color schemes or fonts.

Are extensions safe?

Not necessarily. Since extensions can have so much control over your browsing experience, there’s a lot of potential for malicious extensions to do damage. For example, they could send your data to a third party, or add invisible videos (to inflate view counts) that slow down your browser and drain your battery.

Extensions are created by third-party developers, unaffiliated with the browser’s developer. Whenever you install an extension, you’re implicitly trusting that third-party developer not to be malicious. Extension developers range from large, established companies to individuals, so there’s a wide range of trustworthiness.

Can extensions affect performance on my device?

In addition to the security and privacy risks, extensions can also slow down your browser and drain your device’s battery. Every piece of software on your device needs power to run, and extensions are just that: little pieces of software.

Can I trust extensions from my browser’s extension store?

Browser developers try to keep their extension stores free of malicious extensions, but it’s still possible for unsafe extensions to slip through and be published on the extension store. Browser developers will often specifically vouch for some popular extensions, adding a “Featured” or “Recommended” badge on the extension store listing; those extensions are usually trustworthy. But again, you assume some risk anytime you install an extension.

Should I use, or avoid, extensions?

If you’re concerned about security and privacy, it’s better to minimize your use of extensions, and to only use extensions from trustworthy developers.

If a particular feature is very important to you, it’s better to use a browser that has that feature built in, instead of using an extension. Built-in features are sometimes called “browser-native.” They don’t require you to trust a third-party developer, they have unlimited flexibility, and they are faster and use less battery life on your device than extensions that do the same thing. There’s a trend towards browsers building in popular features that, previously, you could only get from an extension. Tracker and ad blocking is a prominent example: Brave has powerful blocking features built in, so you don’t need to use extensions to protect your privacy.

Browser developers have to trade off extension flexibility against user protection. More flexible extensions allow users to customize their experience as they like, but carry more security, privacy, and performance risks. In the future, it’s likely that browsers will reduce extensions’ flexibility. That’s good for privacy in one way (inhibiting malicious extensions) but bad for privacy in another way (limiting the power of privacy-protective extensions like tracker blockers). Browser-native features don’t have to make this tradeoff at all.