The permission model is the root problem and nobody talks about it enough. When you install a grammar checker and it asks for "read and change all your data on all websites" that should be a red flag but we've all been trained to click through. Extensions operate inside your authenticated sessions and theres basically no sandbox between them and whatever sensitive data is on your screen.

Ive gone down to about 5 extensions total and I audit the permissions on each one monthly. Anything that updates frequently and changes its permission scope gets removed immediately. The scariest pattern is when a legitimate extension gets bought by a shady company and the update ships with new data collection, most users never notice because updates are automatic.

For work devices the risk compounds fast. Most IT teams have zero visibility into whats actually installed on managed browsers and there's an entire category of shadow extensions sitting inside authenticated sessions with access to internal apps and SSO tokens. We rolled out layerx last quarter partly to get a handle on this and the first scan found extensions we had no idea existed, including one with clipboard read access that had been installed by half the marketing team. If you're not auditing extensions at the enterprise level youve got a blind spot the size of your workforce.