CVE-2026-48294: How an Adobe Browser Extension on 329 Million Browsers Leaked WhatsApp Data

The bug, in plain terms

Researchers at Guardio found a flaw in the Adobe Acrobat extension for Chrome, installed on roughly 329 million browsers. Tracked as CVE-2026-48294, it let an attacker steal WhatsApp messages, contacts, and account details from anyone who visited a malicious webpage while the extension was installed.

The mechanics are worth following because they explain why this kind of thing keeps happening. The extension had an internal messaging system, the channel different parts of the extension use to talk to each other, and it did not properly check who was sending those messages. A webpage could send one. That message quietly wrote data into the browser’s local storage, which switched on a dormant Adobe component called Hermes. Hermes then bridged across to WhatsApp Web, where the victim was already signed in, and read their messages in plain text.

Nothing about WhatsApp was broken. WhatsApp’s encryption worked correctly the entire time. Messages are encrypted while travelling between phones and decrypted when they arrive, and the extension was reading them after they had arrived, on the screen, the same way you do. Adobe issued a patch in June after being told about it.

What an extension actually is

Four words do most of the heavy lifting in any conversation about this, and the advice further down only lands once they stop being vague.

An extension (Firefox and Safari usually call it an add-on) is a small program that lives inside your browser. You install it on your computer, the same way you install any other software, and it starts up whenever the browser does. A grammar checker, a coupon finder, an ad blocker, a screenshot tool: each of those keeps running quietly in the background whether or not you are currently using the feature you wanted.

A permission is one specific capability the extension asks for and the browser grants, usually once, in a dialog box during installation. Reading the pages you open is a permission. Seeing your browsing history is another. So is sending you notifications, or changing where your address bar sends searches. Browsers genuinely enforce these, and an extension without a given permission cannot do that thing at all. The weak point sits in the granting, because the request arrives as one short sentence standing between you and the button you want to click.

Local storage is a small filing cabinet the browser keeps on your machine, with a separate drawer for every website and every extension. It holds preferences, settings, and the fact that you are already signed in somewhere. In the Adobe flaw, local storage was the lever. A malicious page arranged for a value to be written into the extension’s drawer, and a sleeping part of the extension read that value and woke up.

A profile is an entire separate copy of a browser’s world: its own bookmarks, saved logins, cookies, history, and its own set of extensions. One installed copy of Chrome can hold several profiles that share nothing with each other. Further down, this turns out to be the most useful tool in the box.

The comparison that survives contact with reality is a spare key. Installing an extension means handing a key to your home to somebody who has offered to water the plants. Almost all of them do water the plants. The awkward facts are that the key opens every room, the lock cannot tell a plant waterer from a burglar, and the holder can pass the key to a stranger without mentioning it to you.

Drawn out, the reach looks like this. Once an extension has permission to act on a page, everything on that page is within arm’s length.

The step that surprises people is the last one. An extension is allowed to talk to a server chosen by whoever wrote it, and nothing on your screen announces when it does.

What an extension can actually see

Most people install an extension the way they install an app, without much thought, and the permissions screen goes by quickly. The mental model is that an extension adds a button.

The reality is closer to giving a piece of software a seat in front of your browser. An extension with permission to read and change data on all websites can see every page you open, which includes your webmail while you read it, your bank account while the balance is on screen, and any messaging app you use in a browser tab. It can see what you type, including into password fields. It can change what a page shows you, which means the account number displayed on a payment confirmation is whatever the extension decides it should be.

That is not a design flaw. Many useful extensions genuinely need broad access: a password manager has to fill fields on every site, an ad blocker has to inspect every page. The trouble is that the permission is the same whether the extension is a password manager or a free wallpaper changer, and the browser cannot tell you which is which.

The Adobe case adds one more wrinkle. This was a well-known extension, from an enormous company, doing exactly what it claimed. The danger came from a mistake in its code, not from bad intentions, and no amount of checking whether the publisher is reputable would have protected anyone.

What the store review does and does not catch

Extensions from the official stores feel vetted, and real checking does happen, so it helps to know what that checking is aimed at.

Google runs a mix of automated scanning and human review on the Chrome Web Store. The automated part hunts for known-bad code patterns and policy breaches. The human part is triggered by particular events, most notably a first submission and any update that asks for meaningfully more permission than the version before it. Mozilla runs a similar process for Firefox add-ons with a smaller catalogue to get through, roughly 35,000 public add-ons against Chrome’s 110,000 or so. Apple routes Safari extensions through the App Store, where they arrive wrapped inside a Mac or iPhone app and inherit that app’s review.

All three catch plenty. The gap that remains is structural rather than a matter of effort.

• Review sees code, and cannot see conduct. Plenty of extensions fetch their instructions from a server after installation. Whatever a reviewer reads can behave perfectly and still be told to do something different next Tuesday.
• A bug breaks no policy. The Adobe flaw would have passed every review, because the code did what it claimed. Its mistake was in how it checked who was talking to it.
• Reputation is inherited rather than earned. When an extension changes hands, the listing keeps its name, its icon, its install count, and its years of five-star reviews. Nothing in the store tells you the owner is new.
• Scale runs against the reviewer. Removals happen in batches, after the fact. Researchers at GitLab reported a set of extensions affecting around 3.2 million users in early 2025. Koi Security documented a coordinated campaign of 18 extensions across the Chrome and Edge stores reaching roughly 2.3 million people. Another cluster, built to copy people’s ChatGPT and DeepSeek conversations, gathered over 900,000 downloads before it was pulled.

Every one of those sat in an official store, with a listing that looked entirely ordinary, for as long as it took somebody to notice.

The practical reading of this is not that stores are pointless. Installing only from the official store still removes an entire category of risk, namely extensions handed to you by a website or bundled into a download, and that category is where the worst material lives. Think of the store as a filter with a wide mesh. It catches the obvious, it lags behind the clever, and it holds no opinion whatsoever about whether you needed the extension in the first place.

Why extensions go bad after you install them

Even a careful person can end up with a hostile extension without doing anything wrong, and the reason is that extensions update themselves silently.

Extensions get sold. A developer builds something useful, acquires a few hundred thousand users, and then receives an email offering money for the project. The new owner pushes an update. Your browser installs it overnight without asking, because that is how extension updates work, and the thing you vetted two years ago is now owned by someone you have never heard of.

Developer accounts also get stolen, usually by phishing, and the attacker publishes an update through the legitimate account. From the browser’s point of view the update is properly signed by the right publisher.

Either way, the check you did at install time covers a version that no longer exists on your machine.

What could go wrong: three ordinary stories

The mechanism is one thing and the lived experience is another. Three shapes cover almost every real case, and none of them require you to have been careless.

The extension that was sold

A developer builds a small tool, perhaps a colour picker or a tab organiser, and it collects two hundred thousand users. Maintaining it is unpaid work with a steady trickle of support emails. Then a message arrives offering a five-figure sum for the listing, and the deal goes through quietly, because no rule requires an announcement. The new owner ships an update adding a few lines of code that fetch instructions from their own server, and every existing user receives it overnight. In March 2026 researchers documented exactly this shape: an extension turning hostile after an ownership transfer and beginning to inject code into the pages its users visited.

Being careful at install time cannot catch this. The version you inspected was clean, and it was replaced while you slept.

The developer who was phished

In December 2024 an attacker sent password-reset style emails to people who publish Chrome extensions, harvested the logins, and pushed malicious updates through the real accounts. Those updates pulled data out of the pages users had open. From the browser’s point of view everything was correct: right publisher, right signature, right listing, right store. Dozens of extensions were affected before anyone spotted the pattern.

The lesson here is uncomfortable. Checking who publishes an extension is sensible and still leaves this door open, because the store sees the genuine account doing the uploading. The attacker had simply moved in behind it.

The free tool with a business model

Coupon finders, download helpers, video grabbers, “unlimited” free VPNs, and shopping assistants share a common problem: running them costs money and they charge nothing. Revenue arrives from somewhere. Usually that somewhere is your browsing, collected page by page, tidied up, and sold on as market research. In January 2026 Google removed a batch of 29 extensions tied to affiliate fraud, the category whose standard trick is rewriting the referral tags on shopping links so that a third party earns commission on purchases people were going to make anyway.

Nothing about that feels like being hacked. No password is stolen, no file is encrypted, and the extension carries on doing the useful thing you installed it for. The cost is a complete record of where you go, held by a company you have never heard of, sold onward under terms you never read.

Here is the path an update travels, identical in all three stories.

You appear only in the last two boxes, and nobody asks you anything in either of them.

Cleaning up, in about ten minutes

This is one of the few security chores with an immediate, visible payoff, because most people are carrying extensions they forgot about.

Open your extensions page. In Chrome and Edge that is the puzzle-piece icon then “Manage extensions”, or type chrome://extensions into the address bar. Firefox uses about:addons. Safari keeps them in Settings, under Extensions.

Go through the list and remove anything you do not actively use. Not “might use someday”. Actively use, this month. Everything you remove is a permanent reduction in risk and costs you nothing, and you can always reinstall if you turn out to need it. Expect to delete more than half.

For the survivors, click Details and read the permissions. An extension that only needs to work on one site should say so, and one that reads data on all sites needs to justify that with what it does. Chrome lets you restrict this per extension: under “Site access”, changing “On all sites” to “On specific sites” or “On click” means the extension does nothing until you deliberately activate it. For anything you use occasionally, this setting is the single best change available, and it barely affects how the extension behaves when you do want it.

Finally, check that the extensions you kept are actually the ones you meant to install. Search the extension store for the name and compare: developer, install count, review dates. Fakes copy the icon and description exactly, and the giveaway is usually a publisher name that is slightly wrong or an account with no history.

The exact steps, browser by browser

That cleanup takes ten minutes once you know where the buttons hide. Menu paths differ between browsers enough to be genuinely irritating, so here they are in full. Do this on every browser installed on the machine, including the one you never open, because an ignored browser still runs its extensions in the background.

Chrome

1. Click the puzzle piece icon to the right of the address bar, then Manage extensions at the bottom of the panel. The typing route is chrome://extensions in the address bar, then Enter.
2. You now have a card for every extension. The toggle at the bottom right of each card switches it off without deleting it, which is useful while you are testing.
3. Click Details on a card. Scroll to Permissions for the full list, and to Site access for which pages it can touch.
4. Remove sits on the card itself and again inside Details. Removal takes effect immediately, with no restart needed.
5. Before leaving, look at the Developer mode switch at the top right. Leave it off unless you know exactly why it is on, and treat any “unpacked” extension listed there as suspicious, since it did not come from the store.

Edge

1. Click the puzzle piece icon, then Manage extensions. Typing edge://extensions gets you to the same page.
2. The three-dot menu at the top right also has an Extensions entry if the icon is hidden.
3. Each entry has Details, and inside it a Site access section with the same three choices Chrome offers.
4. Edge lists Extensions from other stores separately. Anything you installed from the Chrome Web Store into Edge appears there, and it deserves an extra look, having been reviewed for a different browser.

Firefox

1. Open the menu (three horizontal lines, top right) and choose Add-ons and themes. The shortcut is Ctrl + Shift + A on Windows and Cmd + Shift + A on Mac. Typing about:addons works too.
2. Click Extensions in the left sidebar.
3. Click the name of an extension, then open the Permissions tab. Newer add-ons show individual toggles you can switch off.
4. The three-dot menu beside each extension holds Remove, plus Manage, where you will find Run in Private Windows. That setting is off by default and worth leaving that way.

Safari on Mac

1. Open the Safari menu, choose Settings (or press Cmd + ,), then click the Extensions tab.
2. The checkbox beside each name enables or disables it.
3. Select an extension to see what it can read. Safari lists the individual websites it has been granted, each with its own dropdown, plus a single choice covering everywhere else.
4. Uninstall opens a Finder window rather than deleting anything, because Safari extensions ship inside ordinary Mac apps. Drag that app to the Bin to remove it properly.

Safari on iPhone and iPad

1. Open Settings, then Apps, then Safari, then Extensions. On older versions of iOS the path skips the Apps step and goes straight from Settings to Safari.
2. Tap an extension to switch it off, and to set what it may read per website.
3. Deleting the app that contains the extension removes it completely.

Turning “all sites” into “this site only”

Deleting the extensions you never use is the big win. The second-biggest is quieter and costs about fifteen seconds each: telling the survivors where they are allowed to work.

Most extensions install with access to every site, because that is what the developer asked for, and most of them have no need for it. A price tracker for one retailer has no business reading your webmail. A tool that reformats text on one website has no reason to be present on your bank’s login page. Your browser will enforce a narrower rule the moment you set one, and the extension usually behaves identically for the things you actually use it for.

In Chrome and Edge the control lives under Details, then Site access, and it has three positions.

Setting	What the extension can do	Sensible for
On all sites	Reads and changes every page you open, always, without asking again	Password managers, ad blockers, anything you depend on constantly
On specific sites	Works only on the addresses you list, and is blind everywhere else	Retailer tools, single-site helpers, work utilities
On click	Does nothing until you click its icon, then acts on that one tab	Screenshot tools, converters, anything occasional

On click is badly underrated. The extension stays installed, its button stays exactly where it was, and it simply waits to be asked. Should that extension be compromised six months from now, the hostile version sits idle beside your banking tab instead of reading it.

Firefox handles the same idea through the Permissions tab on each add-on’s page. Add-ons built on the newer standard let you switch off “Access your data for all websites” outright, after which Firefox asks you in the address bar the first time the add-on wants a particular site. Older add-ons may offer no such toggle, which is itself a fact worth knowing about how old the code is.

Safari asks the question differently and arguably better. When an extension wants a site it has not been granted before, Safari offers Allow for One Day, Always Allow on This Website, or a refusal. Every one of those decisions can be reviewed later under Settings, Extensions, by selecting the extension and reading the list of sites it has accumulated. Choosing “one day” as a habit costs you a click now and then and keeps the standing permission list refreshingly short.

One caveat, so the expectations are right: a few extensions genuinely break when restricted, usually ones that need to notice something on a page before you have thought to click. Password managers are the clearest example. If an extension stops working after you narrow it, widen it again and accept the trade, having made that decision deliberately rather than by default.

What the permission wording actually means

The permission descriptions browsers show are short and vague, which makes them easy to click past. Translating the common ones helps.

“Read and change all your data on all websites” is the broadest permission there is. In practice it means the extension can see every page you open and alter what appears on it. Everything you read in a browser, and everything you type into one, is available to that extension. Password managers and ad blockers genuinely need this. A note-taking tool or a theme does not.

“Read your browsing history” gives the extension the list of everywhere you have been. That is a detailed picture of your life, including medical searches, job hunting, and anything else you would rather not hand to a stranger, and it is frequently the actual product being sold.

“Change your search settings” and “Change your home page” are the hallmarks of extensions monetised by redirecting your searches through a partner. Annoying rather than dangerous in most cases, and a reliable signal about the developer’s priorities.

“Communicate with cooperating websites” sounds harmless and means the extension talks to a specific external server. Whether that matters depends entirely on what it sends, which the permission does not tell you.

“Display notifications” and “Manage your downloads” are the ones most often used for scams: fake virus warnings pushed as system notifications, or downloads swapped for something else.

The rule that holds up without any technical knowledge is proportionality. An extension should ask for what its job requires and no more. When the gap between what it does and what it asks for is large, that gap is the business model.

Permission wording, translated

Those prompts read differently side by side than they do one at a time, because the wording and the reality drift apart in a consistent direction.

What the prompt says	What it actually allows	Reasonable for
Read and change all your data on all websites	Everything visible on every page, everything typed into every page, and the ability to rewrite what appears	Password managers, ad blockers, translation tools
Read and change your data on example.com	The same total access, aimed at one site	Single-site helpers of any kind
Read your browsing history	The full list of addresses you have visited, with times	Bookmark managers, history search tools
Change your search settings	Which search engine your address bar uses, so queries can be routed elsewhere first	Almost nothing you did not deliberately install for that purpose
Manage your downloads	Seeing what you download, and starting downloads on its own	Download managers, and little else
Display notifications	System-level pop-ups that look like they came from your computer	Calendar and messaging tools
Read and change your bookmarks	The whole bookmark tree, which often contains internal work addresses	Bookmark tools and sync services
Access your tabs and browsing activity	Which tabs are open and what is in them, continuously	Tab managers, session savers
Communicate with cooperating websites	Sending data to a server the developer chose	Anything with an account or a cloud feature
Detect your physical location	Where you are, whenever the extension asks	Weather, maps, local search

Two things fall out of reading it as a table.

The first is that the gap between the top two rows is enormous while the gap in wording is four words. Site-scoped access is the same power pointed at one target. Almost everything that matters about your exposure comes down to how many addresses sit in that list.

The second is that several rows describe capabilities you would find alarming as a spoken sentence and click past as a checkbox. “Read your browsing history” means a stranger being handed a record of your searching for the past three years, medical questions and job hunting included. Written out that way, most people decline. Presented as a line of grey text during a two-second installation, most people accept.

None of this asks you to become suspicious of software in general. It asks for three seconds spent on whether the job the extension does explains the access it wants. A calculator asking to read every page has told you something important about itself.

Keep it or bin it

Most people breeze through half the list and then stall on the same handful: the ones used twice, the ones a colleague recommended, the ones that arrived with something else. A rule that resolves those quickly beats a long deliberation.

The rule is simple. If you cannot remember using it this month, it goes. Reinstalling takes forty seconds and the store holds nothing against you either way. Nobody has ever regretted deleting an extension.

For genuinely borderline cases, work down these questions in order and stop at the first one that answers you.

Three of those questions deserve a note.

Recognising it does more work than it looks. Extensions arrive inside software bundles, get installed by whoever else uses the machine, or ride in with something you agreed to without reading. An extension you cannot account for does not need investigating. Delete it and see whether anything breaks.

Verifying the publisher means opening the store listing and reading the developer name, the install count, and the dates on the reviews. Impostor listings copy the icon and the description exactly. The tells are a publisher name off by one character, a review history that begins three weeks ago, or an install count wildly out of step with how well known the tool supposedly is.

Update dates matter because an abandoned extension is a standing offer to whoever wants to buy it. Browsers change constantly, and code nobody has touched in two years is code nobody will fix when a flaw turns up in it.

One category sits outside the tree and deserves naming: extensions your employer installed. Those carry a note reading “Installed by your administrator” and a greyed-out remove button. That is deliberate, working around it is a bad idea, and there is a better response covered further down.

When something already looks wrong

A few symptoms point specifically at a bad extension rather than a general computer problem, and recognising them saves a lot of fruitless antivirus scanning.

Searches going somewhere unexpected, or results looking different from usual, is close to diagnostic. So is a new toolbar or sidebar you did not install, or your home page changing back after you fix it. Adverts appearing on sites that do not normally carry them, or in places that look wrong, means something is injecting content into pages.

Pages loading slowly across every site, while other applications are fine, points at something processing every page. And redirects, where clicking a link briefly flashes through another address before arriving, indicates traffic is being routed through somebody.

The fix is the same regardless of which extension is responsible. Open the extensions page, disable all of them, and check whether the symptom stops. If it does, re-enable them one at a time until it returns. That takes ten minutes and identifies the culprit definitively, without needing to know anything about how any of them work.

If disabling everything does not help, the problem is elsewhere and the browser’s built-in reset function is the next step, followed by a scan with the security software already on your machine.

A separate profile for the accounts that matter

Everything so far reduces risk. Profiles come closer to removing it, at least for the handful of accounts where a bad day would genuinely hurt.

Recall the definition from earlier: a profile is a complete separate copy of the browser’s settings, with its own cookies, saved logins, history, and its own set of extensions. An extension installed in one profile has no visibility into another, none at all. Create a second profile, install nothing in it, and use it only for banking, tax, health records, and email password resets. An extension problem in your everyday browsing then cannot reach any of those tabs. Setup costs a minute and no money.

Chrome and Edge

1. Click your profile picture or coloured initial at the top right of the window.
2. Choose Add in Chrome, or Add profile in Edge.
3. Pick the option to continue without an account if you would rather it synced nowhere. A locally stored profile is perfectly fine and slightly simpler.
4. Give it a name and a colour you will recognise at a glance. “Money” works.
5. Install nothing into it. That restraint is the entire point.
6. The new profile opens in its own window with its own icon in the dock or taskbar, so you can pin it separately and never confuse the two.

Firefox

1. Type about:profiles into the address bar.
2. Click Create a New Profile and follow the three prompts.
3. Use Launch profile in new browser to open it alongside your normal one.
4. Firefox also offers Container Tabs, a lighter idea that separates cookies between tabs inside a single profile. Handy for staying signed into two accounts on one site, though it keeps no separation between extensions.

Safari

1. Open Safari, then Settings, then the Profiles tab.
2. Click New Profile, name it, and pick a symbol and colour.
3. Switch between profiles from the sidebar or the File menu.
4. Each profile gets its own extensions, history, cookies, and Favourites bar.

People often assume private browsing already covers this ground, which is worth clearing up, because the three options do genuinely different jobs.

Question	Separate profile	Private or incognito window	Separate browser app
Own set of extensions	Yes	No, it uses the ones you have allowed	Yes
Extensions off by default	Only if you install none	Yes in Chrome and Firefox, until you allow them	Only if you install none
Keeps you signed in between sessions	Yes	No, everything clears on close	Yes
Separate cookies and history	Yes	Yes, and discarded afterwards	Yes
Effort to set up	About a minute	None	Ten minutes, plus a download
Best used for	Banking, health, tax, account recovery	One-off visits you would rather not keep	Total separation of work and personal

Private browsing was built to stop your own device remembering things, which is a different goal from stopping software on your device watching things. A profile holding no extensions is the version that addresses the risk in this article.

Habits that keep it clean

Install from the official store for your browser only. Extensions offered by a website, bundled with a download, or sent as a file are the highest-risk category by a wide margin, and there is almost never a good reason to take one.

Be sceptical of free tools that would cost money to run. Coupon finders, download managers, and video downloaders have a long history in this space, because the business model is usually your browsing data and the extension needs broad permissions to collect it.

Do sensitive things in a separate browser profile. Browser profiles are free, take a minute to create, and keep separate extension sets. A profile with no extensions at all, used only for banking and health accounts, means an extension problem in your everyday browsing cannot reach those tabs. This is the closest thing to a complete fix available to a normal user.

Review the list every few months. Put it next to something you already do, like the seasonal clock change, and it stops being a thing you have to remember.

Questions people actually ask

The same handful of questions surfaces whenever this topic comes up, and several have answers that run against the intuition.

Are extensions a problem on my phone?

Mostly no, because most mobile browsers do not support them at all. Chrome on Android offers no extension support whatsoever. Firefox for Android allows a curated and fairly short list. Safari on iPhone and iPad does support them, with one difference in how they arrive: each extension is bundled inside an app you install from the App Store, so it has passed Apple’s app review, and you switch it on in Settings afterwards. The permission model is the same in kind, and the same advice applies, but the numbers are far smaller and the review is tighter. Your laptop is where the attention belongs.

Does incognito or private browsing stop them?

Partly, through a mechanism worth understanding. Chrome and Firefox disable extensions in private windows by default, so anyone who has never touched that setting does get real protection. Any extension you ticked “Allow in Incognito” for, though, is fully present and watching everything you do there. Private browsing by itself restricts nothing about extensions; its job is stopping your browser saving history, cookies, and form entries after the window closes. Two different goals, frequently confused.

Do I need antivirus software for this?

Antivirus is the wrong tool for this particular job. Security software watches files, processes, and network traffic. A hostile extension is a legitimate browser feature doing legitimate browser things with a permission you granted, so there is nothing anomalous for a scanner to notice. Some security suites have added extension checks, and they will flag known-bad listings once those listings have been identified by somebody else. Your own extensions page remains the effective tool, and it costs nothing.

What about extensions my work installed?

Those show a note reading “Installed by your administrator” and no remove button. Your IT team pushed them through browser policy, usually for security monitoring, single sign-on, or web filtering. Removing them is off the table, and trying to work around it is a poor career decision. A better response exists: treat the work browser as a work tool, keep personal banking and personal email out of it entirely, and use your own machine or a separate browser for anything you would rather not see in a corporate log. If a policy-installed extension worries you, ask IT what it does. A reasonable IT team will tell you.

Are Firefox extensions safer than Chrome ones?

Somewhat, for reasons mostly about scale. Mozilla’s catalogue is roughly a third the size of Google’s, which makes human review more tractable, and Mozilla applies a stricter process to add-ons it recommends. Firefox also hands you a clearer per-add-on permission toggle than Chrome does. None of that changes the underlying design, though: an add-on with permission to read every page can read every page. The same campaigns have appeared on both stores, and one documented 2026 operation shipped its extensions to the Chrome and Edge stores simultaneously. Pick your browser for other reasons and apply the same hygiene either way.

Will removing an extension delete something I care about?

Occasionally, so spend five seconds on anything that stores content. Note-taking extensions, highlighters, and clipboard tools sometimes keep data inside the browser rather than in an online account, and removing the extension takes that data with it. Export first if the extension offers an export button. For the overwhelming majority, removal deletes nothing except the extension.

Three checklists worth keeping

Habits stick better with a list to work from, so here are the three moments that matter, written as things to do rather than things to know.

The ten-minute cleanup, done once

1. Open the extensions page in every browser installed on the machine, not just your favourite one.
2. Remove anything you cannot name, and anything you have not used this month.
3. For each survivor, open Details and read the permissions all the way to the bottom.
4. Set Site access to On click or On specific sites for anything that does not need constant reach.
5. Confirm each remaining extension against its store listing: developer name, install count, date of the most recent update.
6. Look for anything marked as installed by an administrator, and separately for anything in Developer mode that you did not put there.
7. Create a second profile with no extensions in it, and sign into your bank from that one.
8. Repeat on your other computer, and on the family machine everyone shares.

The quarterly review, ten minutes

1. Open the extensions page and read the list out loud. Anything you hesitate over goes.
2. Look for entries that have appeared since last time. Extensions arrive alongside other software more often than people expect.
3. Re-read the permissions on anything that has updated. A quiet expansion of access is exactly what you are looking for.
4. Spot-check two listings in the store for a change of developer name.
5. Confirm your no-extension profile still has no extensions in it.

Pin this to something you already do. The clocks changing works well, since it happens twice a year and is impossible to forget.

Before you install anything

1. Ask what problem this solves, and whether a bookmark or a plain website would solve it instead.
2. Read the permission list before clicking Add rather than after.
3. Check the developer name against the company you believe you are installing from.
4. Look at the review dates. A five-year-old extension whose reviews all date from last month deserves a second look, as does a brand-new one with thousands of glowing ratings.
5. Compare the install count against how well known the tool is. Ten million installs for something nobody has heard of is a warning sign.
6. Install it, then immediately set Site access to the narrowest setting that still works.
7. Register it consciously as a thing you now own. The extensions that cause trouble are almost always the ones people forgot they had.

None of this needs doing perfectly. An extensions list read four times a year by somebody willing to delete freely is in better shape than most corporate fleets.

The part that is genuinely reassuring

It would be easy to read all this as a reason to distrust the browser entirely, and that would be an overcorrection.

Extensions are one of the few risks where the fix is completely within your control, takes ten minutes, and does not require buying anything or understanding any technology. There is no ongoing vigilance required and no judgement call about whether a message is suspicious. You are deleting things from a list.

The Adobe flaw affected 329 million browsers and was fixed by a patch, and the people least affected were those who had removed an extension they were not using. Fewer extensions is a smaller target, and it stays smaller without any further effort from you.