Quick answer
To limit browser extension site access, first remove the extensions you do not use, then set each one you keep to run only on click or only on the sites it needs. In Chrome and Edge, open the extensions page, choose Details and change Site access from “On all sites” to “On click” or “On specific sites”. Firefox and Safari have similar per-site permission settings. It takes about ten minutes and shrinks what a bad or hijacked extension could see.
Key takeaways
- Extensions with access to all sites can often read what you see and type on those pages
- Start by removing anything unused; it is the quickest win
- In Chrome and Edge, use On click or On specific sites for most extensions
- Turn off extensions in private or incognito windows unless you need them there
- Be extra careful with AI extensions that read whole pages
- Recheck every three months, and after any security news about an extension you use
📘 Main article: This guide follows our main article, Black October: Why Attackers Want Your AI Keys and What to Do This Week, where reviewing browser extensions is step three of five.
In this guide
- Why are browser extensions a security risk?
- Which extensions should you keep?
- How do you limit extension site access in Chrome and Edge?
- How do you limit extensions in Firefox and Safari?
- What about AI browser extensions?
- What mistakes should you avoid?
- Frequently asked questions
- The bottom line
- Related posts
Browser extensions are brilliant little helpers. They also tend to ask for far more access than they need, and most of us click “Add” without reading the warning.
This guide answers one question: how do you check your browser extensions and limit their site access? It follows our Black October article and Nate B Jones’s video on this month’s security failures, where he urges viewers not to give extensions blanket permissions.
Why are browser extensions a security risk?
Because an extension with broad access sits inside every page you visit. Depending on its permissions, it may be able to read page content, change it and see what you type.
That is fine while the developer is trustworthy. The risk comes when an extension is sold to a new owner, its account is hacked or it pushes a bad update. Limiting site access caps the damage if that ever happens.
⚠️ Warning: Your email, banking, payment and AI dashboards are the pages that matter most. An extension does not need to run on them unless it is built for them.
Which extensions should you keep?
Keep extensions you use every week, from developers you recognise, that are still updated. Remove everything else.
| Question | If the answer is no… |
|---|---|
| Have I used it in the last month? | Remove it |
| Do I know who makes it? | Remove it, or research it first |
| Has it been updated in the last year? | Consider a maintained alternative |
| Does it need every site to do its job? | Limit it to on click or specific sites |
A password manager is a common exception that genuinely needs broad access to fill in logins. Keep it, but make sure it is the official extension from the provider.
How do you limit extension site access in Chrome and Edge?
Both browsers use the same settings, because Edge is built on the same engine as Chrome.
- Type chrome://extensions (or edge://extensions) into the address bar
- Select Remove on any extension you no longer use
- For each one you keep, select Details
- Under Site access, change “On all sites” to On click or On specific sites
- If you choose specific sites, add only the sites it needs
- Turn off Allow in Incognito (or InPrivate in Edge) unless you need it there
- Run Chrome’s Safety Check in settings, which can flag extensions that have been removed from the store
💡 Tip: With “On click”, the extension stays asleep until you select its icon in the toolbar. For many tools, such as screenshot or SEO extensions, that is all you need.
How do you limit extensions in Firefox and Safari?
The idea is the same, though the menus differ. Labels can change between versions.
| Browser | Where to look |
|---|---|
| Firefox | Type about:addons, open an extension, then the Permissions tab. Switch off optional site access you do not need, and check “Run in Private Windows” |
| Safari (Mac) | Safari, then Settings, then Extensions. Select an extension and use Edit Websites to set Ask, Deny or Allow per site |
| Safari (iPhone and iPad) | Settings, then Apps, Safari, then Extensions, and review each one’s website permissions |
What about AI browser extensions?
Treat them as high-access tools. Many AI sidebars and writing helpers read the full page so they can summarise or rewrite it, which can include private emails and documents.
- Limit AI extensions to on click, so they only read a page when you ask
- Check whether the extension sends page content to its own servers, and read its privacy policy
- Never paste API keys into an extension’s settings unless it is from a provider you trust; see How to Store AI API Keys Safely in Env Files, Skills and Plugins
- If an extension asks for your AI key, give it a separate key with a spending cap, as in How to Set an AI API Spending Limit and Usage Alert
If you also let an AI agent browse for you, our guide How to Keep Your AI Agent Safe When It Browses the Open Web covers the extra risks.
What mistakes should you avoid?
- Keeping extensions “just in case”. You can always reinstall one later
- Installing copycats. Check the developer name and reviews before adding one
- Forgetting other browsers and profiles. Each browser and each profile has its own extensions
- Ignoring permission prompts on updates. If an update asks for more access, stop and ask why
🔎 Unconfirmed / rumour: Nate B Jones mentions Chrome’s site access controls in the video but does not name any specific extension as compromised in October 2026. Nothing here suggests that any particular extension is unsafe.
Extensions are one half of the job. The other is the apps connected to your accounts, covered in How to Review and Remove Connected Apps on Your Google Account.
Want the full picture? Read Black October: Why Attackers Want Your AI Keys and What to Do This Week for all five steps to take this week.
Frequently asked questions
How do I see which sites an extension can access in Chrome?
Go to chrome://extensions, select Details on the extension, and look under Site access.
What does “On click” mean for an extension?
The extension only runs on a page after you select its icon, so it cannot read pages in the background.
Will limiting site access break my extensions?
Some will ask for permission when you use them, which is the point. If one stops working, add just that site to its list.
How many browser extensions is too many?
There is no magic number. Keep only those you use regularly, from developers you recognise, and limit their access.
Are AI browser extensions safe?
Some are, but many read whole pages to work. Limit them to on click and check where they send your data.
The bottom line
Every extension with access to all sites is a small risk you carry on every page. Removing the unused ones and limiting the rest takes about ten minutes and leaves you far less exposed. Your next step: open your extensions page now and switch one extension to “On click”.
Related posts
- Black October: Why Attackers Want Your AI Keys and What to Do This Week
- How to Review and Remove Connected Apps on Your Google Account
- How to Store AI API Keys Safely in Env Files, Skills and Plugins
