What is a browser extension?
A browser extension is an add-on installed into Chrome, Edge, Firefox or Safari, normally from the browser's own store: the Chrome Web Store, Microsoft Edge Add-ons, Firefox Add-ons, or the App Store for Safari extensions. Ad blockers, password managers, grammar checkers and single sign-on helpers are common examples. An extension runs inside the browser with whatever permissions the user approved at install time, and it updates automatically through the store.
Extensions vs. plug-ins vs. add-ons
- Extension: runs inside the browser, comes from the browser's store and is limited by its granted permissions.
- Plug-in: a separate program the browser loaded to handle special content, such as Adobe Flash Player or Java applets. Flash reached end of life in 2020, and modern browsers no longer run these plug-ins, but the term still appears in older material and exam questions.
- Add-on: the loose umbrella term for both. Firefox calls its extensions add-ons.
Why extensions are a security risk
An extension with permission to "read and change all your data on all websites" can see page content, including form fields, inject scripts and ads, rewrite links and, in some cases, read session cookies. Common problems:
- Malicious look-alikes posing as coupon finders, PDF converters or copies of popular tools.
- Ownership changes: a popular, legitimate extension is sold, and a later update adds tracking or ad injection.
- Session theft: an extension that can read cookies or page tokens can take over signed-in sessions without the password.
- Performance: every extension uses memory, and some inject scripts into every page.
- Sync: browser sync can reinstall a bad extension on every signed-in device after you remove it from one.
Symptoms of a bad extension
- Injected ads, pop-ups or new tabs on sites that never had them
- Searches redirected to an unfamiliar search engine, or a homepage that keeps changing back
- A new toolbar, or an extension nobody remembers installing
- Slow browsing and high CPU use that drop when extensions are disabled
- "Managed by your organization" on a personal computer, a sign that a policy was added to force settings or extensions
Managing extensions safely
- Install only from the official store, and check the publisher name, reviews, update history and requested permissions first.
- Keep the list short and remove extensions that are no longer used.
- Reject permission requests that do not match the extension's purpose.
- On business devices, use Group Policy or MDM to allow only approved extensions and block the rest.
- Manage them at
chrome://extensions,edge://extensions,about:addonsin Firefox, or Settings > Extensions in Safari.
To find a problem extension, disable all of them, restart the browser and test, then re-enable one at a time until the symptom returns. Remove the culprit. If it comes back, look for an installed program that re-adds it, check browser sync, reset browser settings and run an anti-malware scan.
Browser extension on the CompTIA A+ exam
Extensions appear in Core 2 (220-1202) objective 2.11, which covers safe browsing and choosing trusted over untrusted sources for extensions and plug-ins, and in objective 3.4, which covers troubleshooting browser symptoms such as pop-ups and redirection. If searches started going to an unknown engine after the user installed a shopping add-on, remove the extension and reset the browser settings. If pop-ups continue after notification permissions are cleared, suspect an extension or bundled program. If asked for the safest place to get an extension, choose the browser's official store.