The browser is where almost everything happens: banking, email, work, purchases. It is also where the most passwords are stored and the most extensions installed — often ones nobody has looked at in years.
An extension with permission to read page contents sees the text of your emails, your banking balance and every password you type. That permission is granted at installation, in one click, and never revisited.
Extensions: the main risk
- They change hands. A useful extension gets sold, and the new owner adds tracking or ad injection in an update. Nothing is asked of you: it updates itself.
- Permissions are broad. “Read and change all your data on all websites” is the most common permission and the most dangerous one.
- Nobody removes them. An extension installed for one task stays for years.
What to review
| What | What to look for | How often |
|---|---|---|
| The extension list | Anything you do not recognise or no longer use | Twice a year |
| Extension permissions | “All sites” where “this site” would do | At installation and after updates |
| Saved passwords | Whether they should live here at all | Once, when moving to a manager |
| Sync | What exactly syncs and to which account | Once at setup |
| Site permissions | Camera, microphone, notifications granted long ago | Twice a year |
| Downloads folder | Old installers and documents nobody needs | When convenient |
Passwords in the browser
Better than a text file, worse than a manager, and the reasons are specific.
- Available to anyone at an unlocked computer
- Tied to one browser and hard to move
- Visible to a malicious extension
- No shared vault, no secure sharing
- It checks the domain and will not fill on a fake site
- It generates unique passwords
- Better than reusing one password everywhere
- Enough for accounts holding nothing of value
The domain check is the part worth keeping in mind: it is the same protection a manager gives, and it works against phishing better than human attention.
Settings worth changing once
Why browser updates matter more than most is covered in updates, and separate profiles in shared computers.