I installed a PDF to Word converter extension a couple years ago, purely because it had a decent looking icon and promised to save me from constantly uploading files to random online converters, and I clicked through the permissions request without actually reading it, the way I suspect most people do with basically every install prompt they’ve ever seen. Found out months later, from a security researcher’s writeup that a friend happened to share, that this exact extension had quietly been injecting affiliate links into pages I browsed and, more concerning, had been caught reading form data on certain sites. Nothing catastrophic happened to me personally as far as I could tell, but the sheer casualness with which I’d clicked “Add Extension” that day, for something with genuinely invasive access, has stuck with me since, and it’s basically the reason I now actually vet these things before installing rather than just trusting a nice looking icon and a convincing description.

The first thing I actually look at now, before anything else, is the permissions the extension is requesting during install, because this is honestly the single most informative signal available and it’s sitting right there in front of you every single time, mostly ignored. If a simple ad blocker, or a basic screenshot tool, or a color picker is asking for permission to “read and change all your data on all websites you visit,” that’s a massive, disproportionate ask relative to what the extension’s stated function actually requires, and it should immediately raise an eyebrow. Some extensions genuinely need broad access because of what they legitimately do  a password manager, for instance, has a real functional reason to interact with form fields across most sites you visit. But a simple utility tool requesting that same sweeping access is a mismatch worth pausing on, and I’ve genuinely started asking myself, every single time now, whether the permission being requested actually makes sense given what the extension claims to do, rather than just clicking through because the request screen feels like an obligatory formality standing between me and the thing I actually wanted.

Developer reputation is the next thing I check, and I’ve learned to be a little more skeptical here than I used to be, because a professional looking store listing genuinely doesn’t guarantee much on its own anymore. I look specifically for whether the developer is verified, which Chrome’s store does flag for some publishers, and I look at whether the developer has other extensions listed, and if so, whether those have any kind of track record or reviews worth checking. A single developer account with one extension, published recently, with a suspiciously polished description and stock photo style promotional images, is a pattern I’ve started recognizing almost instinctively at this point, even though I couldn’t have told you exactly what made me suspicious of anything a couple years back.

Reviews are useful, genuinely, but I’ll be honest, I’ve become fairly wary of taking them entirely at face value, because fake reviews are a real, documented problem across extension stores just as much as they are on shopping sites. What I actually look for isn’t the star rating itself so much as the specific content of the negative reviews, because those tend to be far more informative than the positive ones. A cluster of one star reviews specifically mentioning things like “started showing weird ads after a week,” or “changed my browser homepage without asking,” or “kept crashing other tabs”  that pattern, repeated across multiple genuinely distinct reviewers describing similar specific problems, tells me a lot more than a wall of generic five star reviews ever could, since those generic glowing ones are honestly the easier ones to fake convincingly at scale.

Something I didn’t think to check for a long time, and genuinely wish I had from the beginning, is the last updated date, visible on most extension store listings if you scroll down to the details section. An extension that hasn’t been updated in two or three years is a bit of a mixed signal, honestly, worth sitting with rather than treating as an automatic red flag either way. Sometimes it just means the tool does one simple thing well and genuinely doesn’t need frequent updates, which is fine. But it can also mean the developer has abandoned the project entirely, and abandoned extensions are sometimes bought up by different parties specifically to inject malicious code into an existing user base that already trusts and has installed it, without those existing users ever getting a clear signal that ownership or intent behind the extension has quietly changed. I’ve started specifically searching an extension’s name alongside words like “ownership change” or “sold” before trusting anything that’s been sitting untouched for years but still has a large existing install base, just because that particular scenario has become common enough to be a genuine pattern worth checking for.

Install count, I’ve realized, is honestly one of the weaker signals despite how much weight people, myself included previously, tend to give it. A huge install count tells you the extension is popular, sure, but popularity and safety aren’t the same thing at all, and there have been well documented cases of extensions with millions of installs turning out to be doing something shady behind the scenes, sometimes for years, before it finally got caught and reported. I still glance at install numbers, mostly just to rule out something that looks brand new with zero track record, but I’ve stopped treating a large number as any kind of meaningful safety guarantee on its own.

For anything I’m genuinely unsure about, especially extensions requesting broader permissions than I’m fully comfortable with but that I still want to actually use, I’ll do a quick search combining the extension’s exact name with the word “malware” or “review” or “safe,” just to see if any security researchers or tech outlets have written anything specific about it. This has caught a couple of genuinely sketchy extensions for me before I installed them, purely because someone else had already done the deeper investigative work and published it publicly, and honestly, leaning on that existing research rather than trying to personally audit every extension’s actual behavior myself feels like the realistic, sustainable approach for someone who isn’t a security professional and doesn’t have the time or technical background to reverse engineer extension code line by line.

If I’m being completely honest about where I’ve landed after that whole PDF converter situation, it’s that I’ve become genuinely more conservative about installing extensions at all, not just more careful about vetting the ones I do install. I used to have probably twenty extensions active at any given time, most half forgotten, most granted broad permissions I never actually thought through. Now I keep maybe six, all ones I use regularly enough to actually justify the access they’ve been granted, and I’ve made peace with the small extra friction of occasionally uploading a file to a proper website instead of trusting some random extension’s shortcut version of the same task. It’s a genuinely boring habit change, nothing dramatic about it, but it’s the kind of boring that actually protects you, which I’ve come to appreciate a lot more than I used to.