Your browser is probably the program you use most. Email, banking, work documents, shopping and social media all pass through it. That also makes it one of the most attractive targets for anyone wanting to steal data. Two things deserve particular attention: the extensions you install and the settings that decide what websites are allowed to do.
Why extensions are sensitive
An extension is a small program that lives inside the browser. To work, it may request very broad permissions, such as "read and change all your data on all websites". With a permission like that, an extension can technically see what you type, read your banking pages, change links and insert adverts.
Many extensions are honest and useful. Problems arise in a few typical scenarios:
- extensions that are malicious from the start, posing as useful tools (converters, video downloaders, themes, coupon finders) but harvesting data;
- extensions that get sold: a developer hands a popular extension over to a new owner who, through an automatic update, adds tracking or intrusive advertising;
- compromised developer accounts: someone gets into the publisher's account and pushes out a modified version.
In all these cases the extension updates itself without you noticing.
How to assess an extension before installing it
- Do you really need it? Many functions, such as pop-up blocking, translation or password saving, are already built into the browser.
- Who publishes it? Prefer well-known developers with a website and a clear privacy policy.
- What permissions does it request? An extension that changes tab colours doesn't need access to every website. If the permissions are out of proportion, skip it.
- What do recent reviews say? A sudden wave of complaints about adverts or redirects is often a sign of a change in ownership.
- Install it only from the browser's official store, never from files downloaded from outside websites.
Limiting permissions
Modern browsers let you decide which websites an extension can act on. In Chrome and Edge, for example, you can set an extension to work only when you click its icon or only on specific sites. For extensions you use rarely, this is a very effective safeguard.
Regular clean-ups
Every few months open the extensions page and ask yourself about each one: do I still use it? Do I remember why I installed it? Remove the ones you don't need. Fewer extensions means less third-party code with access to your data.
The settings that matter
Safe browsing
Chrome, Edge and Firefox offer a system that warns you when you visit sites known for phishing or malware. Make sure it's on. Some browsers offer an enhanced protection mode that updates the list of dangerous sites more quickly.
Updates
The browser almost always updates automatically, but the update is applied only on restart. If your browser stays open for weeks, close and reopen it when you see the prompt.
Site notifications
Many websites ask you to "allow notifications". Some do so in order to send fake virus alerts or misleading adverts straight to your desktop. In the settings, block notification requests by default and remove any sites you don't recognise from the allowed list.
Downloads
Set the browser to ask where to save each file: it forces you to notice what you're downloading. Be wary of downloads that start automatically when a page opens.
Saved passwords
If you use the browser's password manager, protect your browser account with a strong password and two-step verification. If you use a separate password manager, turn off password saving in the browser to avoid duplicates.
Separate profiles
You can create different profiles in the same browser: one for work, one personal, one for banking with no extensions installed. Each profile has separate cookies, extensions and history. It's a simple way to reduce interference between different activities.
Signs that something is wrong
- Your home page or search engine has changed without you deciding to.
- Adverts appear on sites that normally don't have them.
- Search results are redirected to unknown sites.
- New toolbars or extensions you don't remember installing.
In these cases, check your extensions, remove any suspicious ones and use the browser's reset settings feature. Then change the passwords of your main services, starting with email.
In short
- Extensions can access everything you see and type in the browser.
- Install only what you need, from trustworthy developers and the official store.
- Limit permissions to the sites required and clean up regularly.
- Turn on safe browsing, block site notifications and restart the browser to update it.
- Use separate profiles for work, personal life and banking.