Extensions are browser add-ons built with web technologies such as JavaScript, HTML, and CSS. They can use browser APIs to change the user interface, manage tabs, intercept requests, store data, and, in some cases, read or modify web pages through content scripts. Because they run inside the browser, extensions often sit between trusted browser features and untrusted web content.
This makes extensions a sensitive security boundary. A malicious or compromised extension can steal credentials, inject code into pages, alter downloads, or collect browsing data. Attackers may abuse overly broad permissions, vulnerable update channels, or malicious code hidden in an otherwise legitimate add-on. Defenders reduce risk by allowing only trusted extensions, reviewing requested permissions, limiting access to sensitive sites, and removing anything unnecessary. In browser security incidents, extension plumbing matters because a flaw there can expose both user data and privileged browser capabilities.