Safeguard
Security Guides•

How to audit your Chrome extensions in five minutes

A five minute routine to review every Chrome extension you have installed: check site access, incognito, and what to remove, using only built in settings.

Safeguard Security Team
3 min read

You can audit your Chrome extensions in five minutes with built in settings: open Manage extensions, remove anything you do not use, set site access to "On click" or specific sites, turn off incognito access, and check each remaining extension's details. No extra tools are needed.

Step 1: List what you have

Open the Chrome menu, choose Extensions, then Manage extensions. Write down the count. Most people are surprised by it. Every extension is code that runs with your browser's trust, so each one needs a reason to be there.

Step 2: Remove what you do not use

If you cannot say what an extension does or when you last used it, remove it. Right click its toolbar icon and select Remove from Chrome, or select Remove on its card in Manage extensions. Disabling is a weaker option because the code stays installed.

Pay special attention to anything you installed for a single task, such as converting a file or grabbing a coupon. Those are the ones that linger for years.

Step 3: Narrow site access

Open Details on each remaining extension. Chrome lets you set site access to one of three options: "On click", "On specific sites", or "On all sites". For specific sites, you add or remove entries under Allowed sites.

A password manager may reasonably need all sites. A screenshot tool, a color picker or a JSON formatter usually does not. Try "On click" first and see if the extension still does its job.

Step 4: Check incognito and pinning

In Details, the incognito option is off by default. Leave it off unless you have a reason. Private windows are where you expect less tracking, so an extension with access there deserves a second look.

Step 5: Look at who made it

Open the extension's store page from its Details. Check the developer name, the privacy section, and whether the stated purpose matches the permissions. Chrome's own help notes that with Enhanced protection on, Chrome warns you if an extension is not trusted, and that new developers can take a few months to earn that status.

What to do on a work machine

If your organization manages the browser, some extensions may be blocked or forced on you. Do not fight it. Raise requests with whoever owns the policy. For the admin side, see how to block Chrome extensions company wide.

Quick check

Is disabling an extension as good as removing it?

No. A disabled extension is still installed, and you may re enable it later without noticing a permission change. Remove extensions you do not need.

How often should I repeat this?

Every few months, and any time a browser warns you that an extension needs a new permission. Chrome disables an extension until you accept a new warning permission, so that prompt is worth reading.

Sources

Last reviewed: 19 October 2026.

Never miss an update

Weekly insights on software supply chain security, delivered to your inbox.

Self-healing security runs on Safeguard.

Your first fix PR is minutes away.

No sales call required, even your agent can complete the purchase over MCP.