The browser extension a colleague installed is copying your logins

A colleague found a handy browser extension — a PDF converter, a colour picker, a coupon finder, something that made one small task easier — and installed it. It asked for permission to “read and change all your data on the websites you visit”, which every second extension asks for, so they clicked Add and got on with their day. It does what it promised. Nobody thought about it again.

Here’s the quiet failure. That permission is close to total: an extension that can read every page you visit can also read what’s on the page after you’ve logged in — including the session cookie, the small token your browser holds that keeps you signed in. Steal a live session cookie and you don’t need the password or the second factor; you’re simply already logged in as that person. In 2026, whole batches of malicious extensions did exactly this — quietly copying cookies every fifteen to sixty seconds and shipping them out — which let attackers walk straight into Workday, Google Workspace and other tools with nothing typed at a login screen at all.

Why it stays invisible

Extensions live in a blind spot. Nobody signs off on them the way they’d sign off on installing new software on a work laptop — they’re “just a browser thing”, added in two clicks, and there’s no list anyone maintains of what the team is running. So they accumulate, unwatched, each with permissions granted once and never reviewed.

The permission model doesn’t help. The prompt that says “read and change all your data on the websites you visit” is the normal request for a huge range of perfectly legitimate extensions, so it has trained everyone to click through it. There’s no way, at install time, to tell an honest ad-blocker from a cookie-stealer — they ask for the same thing.

And the betrayal often comes later. An extension can be entirely honest for a year, build up a large, trusting user base, and then be sold or hijacked — at which point an automatic update pushes new, hostile code to everyone who has it, with no fresh prompt and no visible change. The icon in the toolbar looks identical the morning it turns. Nothing on your screen tells you the tool you’ve trusted for months started copying your session a minute ago.

Find it yourself

You can review every extension you’re running in about ten minutes, and it’s worth doing on each browser you use.

1. Open the extensions page. In Chrome or Edge, type chrome://extensions (or edge://extensions) into the address bar and press Enter. In Firefox, open the menu and choose Add-ons and themes.
2. Turn on Developer mode (top-right toggle in Chrome/Edge). This reveals each extension’s ID and a bit more detail — useful for the steps below.
3. Go through them one at a time and ask a blunt question of each: do I know why this is here? Anything you don’t recognise, don’t remember installing, or no longer use — remove it. Unused extensions are pure risk with no upside.
4. Check what each one can do. Click Details and read the Permissions and Site access. An extension set to run on all sites with permission to read and change data is the high-risk category — fine for a tool that genuinely needs it (a password manager, say), a red flag for a simple utility that shouldn’t need to see your banking session.
5. Sanity-check the ones you keep. On the extension’s store page, look at the developer, the review count and recent reviews. A sudden flurry of complaints about odd behaviour, or an “owner has changed” note, is a reason to remove it. Where a browser or store lists when an extension last updated or changed hands, glance at that too.

The moment that lands is usually step 4: some long-forgotten converter turns out to have had permission to read every page — including every login — the whole time.

The fix

The aim isn’t to ban extensions. It’s to treat them as installed software rather than harmless decoration.

Prune to what’s used and trusted. Fewer extensions, each with a clear reason to exist, is the whole strategy. Favour ones from known developers with a real user base, and remove anything you’re keeping “just in case”.

Constrain what you keep. For each extension you rely on, set its site access to on specific sites or on click rather than on all sites, where the browser allows it. A currency converter you invoke now and then does not need standing permission to read your email.

Agree who decides. For a team, the fix that actually holds is a shared understanding that extensions get a quick sanity-check before they go on a work browser — and, if your setup supports it, a managed allow-list so a hijacked extension can’t silently push hostile code to everyone. That’s the difference between a one-off tidy and a gap that stays closed.

Assume a stolen session, and shorten its life. Because a lifted cookie sidesteps the password entirely, the backstop is making sessions expire sooner and requiring a fresh sign-in for sensitive actions. If you ever suspect a bad extension, sign out everywhere (most services have a “sign out of all sessions” button) to invalidate any cookie already taken.

A tidy, deliberately chosen set of extensions is a five-minute habit that removes an entire category of quiet break-in — the kind where no password was ever phished, because none was ever needed.