How to check what a Chrome extension can access
Every extension you install declares what it needs access to, and Chrome shows you the list once, in a dialog most people click through. This is how to read that list afterwards, and how to tell an ordinary request from one worth pausing over.
Where to look
Open chrome://extensions, find the extension, and click Details.
Two sections matter. Permissions lists the browser features it can use.
Site access says where it runs: on every site, on a named list, or only when
you click it.
Before installing, the same information is on the store listing, below the description. It is easier to read there, because nothing is running yet.
What counts as normal
Most permissions are unremarkable. Of the 49,702 extensions we have examined, the most common request by a wide margin is simply the ability to save settings, which tells you nothing at all about an extension.
Site access is the request that actually matters, and it is more common than most people expect: 30% of the extensions we examined can read and change data on every site you visit. For a content blocker, a password manager or a translation tool, that is simply what the job requires. For a theme, a calculator or a tab organiser, it is worth asking why.
The combinations worth a second look
A single permission is rarely the story. What raises the stakes is pairing broad site access with something that can be carried off the page:
- Every site plus cookies — cookies are what keep you signed in, so this pairing can reach accounts without ever seeing a password. 2% of the extensions we examined ask for both.
- Every site plus history — the page you are on plus everywhere you have been. Only under 1% ask for history at all.
- Talking to a program on your computer — legitimate for password managers and hardware tools, unusual otherwise. under 1% of what we examined asks for it.
- Controlling your other extensions — the ability to disable what else you have installed. under 1% ask for it, and almost nothing needs it.
None of these is evidence of wrongdoing. They describe what an extension could do, and the reasonable question is whether what it does for you needs that much room.
Narrowing what an extension can reach
You do not have to accept the default. On the extension's Details page, under Site access, you can change it to On click, so it only runs when you press its icon, or On specific sites, so it runs only where you need it. Most extensions keep working. The ones that break usually needed the access for a reason you can now see.
Checking one without installing it
Paste a store link into our check page and it will show what the extension declares, what each permission means in plain words, when it was last updated, and whether it is still on a platform Chrome supports.