← All reels

Decoded

What is a Chrome extension, really?

This little piece could read everything you type.

  1. 1

    A tiny program inside your browser.

    It's built from web code (HTML, CSS, JavaScript) plus one file, manifest.json, that tells Chrome what it's allowed to do.

  2. 2

    It sits on top of every page.

    Its scripts can run inside the sites you open. That's how ad blockers, grammar checkers and dark-mode tools work everywhere.

  3. 3

    Websites are walled off.

    A website only sees itself. It can't read your other tabs. An extension with access can see across all of them.

  4. 4

    That's why Chrome asks first.

    “Read and change all your data on all websites” sounds scary because it is. It's a key to every site you visit.

400K

users hit by one hijacked update.

In December 2024, attackers phished the developer of the Cyberhaven extension, pushed a malicious update, and stole logged-in session data from about 400,000 users.

Stay safe

  • Site access: “On click”

    Extensions → Details → Site access. It only runs when you tap it.

  • Delete what you don't use

    Every extension is a key you've handed out.

  • Trust the developer

    Known publishers, real reviews, recent updates.

  • Read the permission prompt

    Does a calculator need “all your data”?

Only hand keys to people you trust.

Sources

  • Chrome for Developers, “Extensions” and “Manifest file format”
  • Cyberhaven incident disclosure, December 2024

Next reel

This candy is glass. You can eat it.