Is this Chrome extension safe? A 2026 audit guide (permission checklist inside)

On August 31, 2026, Google removed every remaining Manifest V2 extension from the Chrome Web Store. It was the final step of the platform's biggest-ever security cleanup — MV2 extensions had already been disabled in every copy of Chrome since version 138 in July 2025, and the last developer workarounds were deleted in Chrome 150-151.

If that sentence makes you think "great, Google fixed it, my extensions are safe now," keep reading — because the same month that purge completed, Socket published two reports that prove the opposite. The extension threat didn't die with Manifest V2. It evolved, and the shape it took in 2026 is the one review badges can't catch.

This is a plain-English guide to auditing your own extensions: what each scary permission actually means, which combinations are genuinely dangerous, the one-time 10-minute cleanup, and the recurring habit that catches the attacks manual audits miss. No security background required.

Why the old "trust the store" rule stopped working

The attacks of 2024-2026 share one pattern: the malicious version arrives as an update, not as an install. The extension passes review, builds a real user base, and gets weaponized months or years later.

• ShadyPanda (reported December 2025). A group published 150+ legitimate extensions starting in 2018, earned Featured and Verified badges, accumulated ~4.3 million users, then pushed malicious updates that turned wallpaper and productivity tools into affiliate-fraud injectors and spyware. Five top extensions went from clean to a backdoor capable of delivering ransomware in a single automatic update. Coverage via The Hacker News.
• Fake AI extensions (January 2026). Two extensions impersonating AI toolbars — one of them carrying Google's "Featured" badge — were caught stealing users' full ChatGPT and DeepSeek conversation histories every 30 minutes. Combined installs: 900,000. Researchers later watched one of them get reinstated clean, then re-poisoned with a monetization payload in July 2026 (The Hacker News, Aug 2026).
• The 737-VPN network (August 2026). Socket found 737 fake VPN/proxy extensions across 40+ developer accounts, 274 of them impersonating Proton VPN, NordVPN, Surfshark and others. They routed a user's entire browser session through one SOCKS5 proxy provider — a man-in-the-middle position over every unencrypted request — and 221 were only removed after disclosure.
• The crypto framework (August 30, 2026). 19 modules draining EVM, Solana and Tron wallets, replacing Ledger and Trezor sites with phishing pages, and harvesting Coinbase, Binance and MetaMask sessions. Five of the extensions were bought from their original developers, then poisoned via automatic updates — one had 70,000 users when it turned (BleepingComputer).

Across the late-2024 to early-2026 campaigns tracked by Koi Security, GitLab and Cyberhaven, Google removed or disabled extensions affecting more than 8.8 million users. Roughly 60% of extensions in the store haven't been updated in 12 months — abandoned code whose day-one permissions keep working forever.

The lesson of every one of these incidents: you don't audit an extension once. You audit the permission grant, which lives until you revoke it. The permission is the contract; reviews, stars and badges are just vibes attached to an older version.

What Manifest V3 actually fixed — and what it didn't

MV3 is a genuine security upgrade. It bans remotely hosted code (all executable code ships in the package and gets reviewed), replaces always-on background pages with service workers that terminate when idle, and replaces raw request interception with the declarativeNetRequest API. It also made the 2026 purge possible: legacy code with the old attack surface simply stops running.

What it does not do is constrain what a user can be talked into approving. MV3 extensions can still request <all_urls> host permission, still read form fields, still get sold to a new owner, and still receive an automatic malicious update. Every campaign above passed the store's review with the code it had at submission time. MV3 raised the floor; it didn't remove the blast radius of a broad permission grant.

The permission screen, translated into plain English

Open chrome://extensions, click Details on any extension, and scroll to Permissions and Site access. Here's what each line actually grants, and how suspicious to be:

Some context for the scariest line: among extensions with 100,000+ users, roughly half request all-sites access — it's the only way a grammar checker, web clipper or password manager can do its job (Crawlora, July 2026). The permission is a capability, not a confession. The test is the mismatch: does this feature need this grant?

The dangerous combinations

A single permission rarely tells the story. The pairings do:

• All-sites + cookies → account takeover without a password.
• All-sites + browsing history → a complete resellable profile of your life online.
• Scripting + webRequest on all sites → silent page rewrites, fake login forms, injected ads.
• All-sites + native messaging → handing your data to a program outside Chrome's sandbox.

Apply the pessimistic ownership test from Franklin eTech's audit guide: assume this extension's developer will eventually sell it, get phished, or push a bad update. Given the permissions, how bad is that day? If the answer is "it could read my banking session," the feature has to earn that risk.

The 10-minute audit (do this once, today)

If you find an extension in the news for malware, removal from the store does not uninstall it from your machine — that step is always manual. After removal, rotate the password for anything sensitive you did while it was active, and check logged-in sessions in your account settings, especially if it held cookie or wallet permissions.

The part a one-time cleanup can't fix

Here's the uncomfortable pattern in the 2026 data: the ShadyPanda extensions were clean for seven years. The fake AI extension was clean, banned, reinstated clean, and then poisoned two weeks later. The crypto extensions changed owners. A perfect audit on January 1st doesn't protect the machine on July 31st, because the thing that changes isn't your behavior — it's the code on the other end of a permission you'll never be asked about again.

Chrome does warn you when an update requests new permissions — never auto-approve those, read them like a fresh install. But ownership changes and same-permission abuse produce no prompt at all. That's why security teams treat extensions as ongoing governance (inventory, review, revocation) rather than a one-time setting:

• Repeat the audit quarterly (5 minutes once the first one is done); monthly if the machine touches financial, health, legal or corporate data.
• Audit immediately after any update that asks for new access, and the moment you see redirects, mystery tabs, changed search settings, or slowdowns.
• Experimental tools go in a separate browser profile with no saved passwords — if one turns, the blast radius is a throwaway profile.

If monitoring every update yourself sounds like exactly the kind of thing that gets forgotten after two weeks — that's the normal failure mode, and it's why we built a tool for it.

Wrapping up

Manifest V3 and the August 2026 purge made the average browser meaningfully safer than it was a year ago. But the 2026 threat model isn't bad installs — it's updates to good installs, sold extensions, and permission grants that outlive your memory of making them. The defense is boring and effective: prune hard, read the permission screen with the table above, set "on click" everywhere you can, and put the audit on a calendar.

If you also run an AI product and think billing is the other "install once, haunt you forever" layer of an indie SaaS, our field notes on shipping token metering with Stripe walk through the edge cases the docs skip.

Frequently asked questions