What to do if you installed a malicious browser extension

If you suspect a malicious browser extension, remove it first, then assume whatever it could see is exposed. Rotate passwords and revoke sessions for sites you used while it was installed, check for other unknown extensions, and report it to the store and to your security team if you have one.

Step 1: Remove it

In Chrome, right click the toolbar icon and select Remove from Chrome, or open Manage extensions and select Remove. Disabling is not enough. If the extension cannot be found or keeps returning, check whether a work policy installs it, and tell your administrator.

Do this before anything else. The longer it stays, the more it can see.

Step 2: Work out what it could see

Look at the permissions and site access it had. Chrome's documentation says content scripts can read and change page content, so an extension with access to all sites could read pages you viewed and fields you filled in. An extension limited to one site had a smaller window.

Write down the date you installed it and the sites you used since. That list drives the next steps.

Step 3: Rotate and revoke

For sites that matter, change the password from a clean device if possible, and sign out of all sessions. Prioritize:

1. Email and identity provider accounts.
2. Source hosting, package registry and cloud accounts, along with any API keys or tokens you pasted into pages.
3. Banking and payment sites.
4. Anything holding saved cards.

Sessions matter as much as passwords. An extension that could read a page may have taken a session cookie or token, so signing out everywhere and reissuing tokens is part of the job. Cookies are reachable through the cookies permission, which Chrome's permission reference lists without a warning message, so do not assume you would have been told.

Step 4: Check for others

Review the rest of Manage extensions. Remove anything unknown. On Chrome, if an extension seems corrupted after repair, Chrome's help suggests running antivirus or anti malware software.

Step 5: Report

Report the extension to the store, and tell your security team or administrator. If this is a company device, treat it as an incident and keep notes: extension name, ID, install date, permissions and what accounts were used.

Step 6: Reduce the chance of a repeat

• Narrow site access to on click or specific sites.
• Remove extensions you do not use.
• Use a managed allowlist on work devices. See how to block Chrome extensions company wide.

For developers, remember that browsers are not the only place extensions run. Check IDE extensions too, since they can reach source code and tokens.

Quick check

Sources

• Manage Chrome extensions (Google Chrome Help)
• Install and manage extensions (Chrome Web Store Help)
• Content scripts (Chrome for Developers)
• Permissions list (Chrome for Developers)

Last reviewed: 19 October 2026.