The extension that could read everything
On 11 August 2026 I removed a browser extension I had been using: a full-page screenshot tool. It had not done anything wrong. I removed it because of the access it held. Tools of that kind commonly ask to read and change your data on every website you visit, at all times, and that is granted once at install and then simply carries on.
That is standing access. Every page you open, every time, whether you press the extension’s button or not. For a tool whose whole job is “take a picture of the page I am looking at right now”, that is a great deal more than the job needs.
Most permission lists sit there unread
I do not think this makes me careful. I had used that extension happily without ever reading its permissions. Extensions ask for access at install, Chrome shows a line or two, and most of us click through, the same way we click through anything standing between us and the thing we actually wanted to do. Nobody teaches you to check. You just have to happen to look.
That is the point of this article. The check takes about thirty seconds, and Chrome has always let you run it. You do not need to know anything about code.
How to check any extension in thirty seconds
- Open a new tab and go to
chrome://extensions. - Find the extension you want to check and press Details.
- Scroll to the Permissions section.
- Read what it says. That is the whole check.
Do this now, on whatever extensions you actually have installed. It takes less time than reading this paragraph twice.
What the phrases actually mean
Chrome’s permission wording is plain English, but it helps to know what the common ones mean in practice.
“Read and change your data on all websites” is as broad as a permission gets. It means the extension can see and alter every page you open: your email, your bank, your shop’s admin panel, a client’s private link, anything at all. It does not mean the extension IS reading all of that. It means it COULD, at any time, without asking you again.
“Read your browsing history” means exactly that: a list of the sites you have visited. Some extensions genuinely need this, such as a duplicate-tab cleaner. Most do not.
“Read and change your data on [one specific site]” is much narrower. The extension can only act on the domain named, not on everything you open. A tool that only works on one marketplace, or one email provider, asking for exactly that site is a reasonable, matched request.
An extension that asks for almost nothing (no host access at all, perhaps just “read your tabs”) is telling you it does not need to see your page content to do its job.
Chrome also lets you narrow site access on many extensions to “On click”, meaning the extension only gets access to a page when you actually press its toolbar button, rather than all the time. Where that option exists, it turns a standing permission into an on-demand one, and it is worth setting even for extensions you already trust.
The question that matters
The point is not “is this scary”. Almost every extension with broad access is not doing anything wrong. The point is simpler: does the access match the job?
A currency converter that wants to read and change data on every site, at all times, is worth a second look. Converting a number on the page you are viewing does not need standing access to every other page you will ever open. A password manager asking for the same breadth has an obvious reason: it has to recognise login forms wherever they appear. Same permission, different question, different answer.
That is the whole judgement. Not “extensions are dangerous”. Just: what does this thing do, and does what it is asking for match that.
What I replaced it with
Once I had looked properly at the access I had been carrying around, I had a replacement built for myself: a full-page screenshot tool with the narrowest permission set the job allows.
It asks for two things. activeTab, which Chrome grants only for the one tab whose toolbar button you press, and only until you navigate away. And scripting, which lets it scroll that one tab to photograph the parts below the fold. That is the whole list. No host permissions, so no standing access to any site, ever. No access to other tabs, your cookies, your history or your downloads. It makes no network connection at all, so nothing it captures ever leaves your computer.
It went on the Chrome Web Store, free, on 17 August 2026: Full Page Screenshot.
I am not telling you it is more secure than whatever you already use, and I have no idea whether other screenshot tools out there behave well or badly. I only checked mine, on the same thirty-second screen described above. That is the habit worth taking from this, more than the tool itself: open chrome://extensions, press Details on the things you have installed, and read what they are actually allowed to do. You already have everything you need to run that check. Most of us simply never have.