Myth: if an extension is in the official store, it is safe. Fact: stores review extensions and enforce published policies, which lowers risk, but their own documents describe rules and signals, not guarantees. You still need to check permissions, publisher and purpose.
Myth 1: Review means someone read every line forever
Fact: review is a point in time check against policy. Mozilla's policies describe code review and basic functional testing, and say Mozilla can reject or block versions or whole add-ons afterwards. Chrome's policies set requirements such as no remotely hosted logic and no obfuscation. Neither document promises that a later update is safe.
Myth 2: The remote code ban makes malicious updates impossible
Fact: the ban means logic must ship in the package, which makes each version inspectable. A malicious version can still be shipped in the package. See the remotely hosted code rule.
Myth 3: A permission warning list tells the whole story
Fact: some permissions show no warning in Chrome's reference, including cookies, webRequest, storage and scripting. Site access is shown separately. Read both. See permission warnings decoded.
Myth 4: Trusted badge equals trustworthy publisher
Fact: Chrome's help says extensions count as trusted when developers follow the Developer Program Policies, and that new developers can take a few months to earn that status. It is a useful signal that Chrome warns on when Enhanced protection is on. It tells you about policy compliance, not about the intent of whoever controls the account tomorrow.
Myth 5: Stores stop deceptive installs completely
Fact: the policies prohibit deceptive installation tactics, such as misleading ads or bundling other extensions, which implies those tactics exist. Install from the store listing yourself, not from a pop up that pushes you.
What the stores genuinely give you
- Published rules you can hold publishers to.
- A path to report and remove bad extensions.
- Data use limits. Chrome's policy prohibits collecting web browsing activity beyond what the single purpose requires and bans selling data to brokers.
- Warnings on permission changes. Chrome disables an extension until you accept a new warning permission.
What stays with you
- Install fewer extensions.
- Match permissions to purpose.
- Narrow site access.
- Remove what you stop using.
- Check again when permissions change.
Our five minute audit turns that into a routine.
Quick check
Is a sideloaded extension always worse than a store one?
Not automatically, but you lose store review and policy enforcement. On Chrome for Windows and macOS, local CRX installs are blocked in normal use, according to Chrome's documentation, to protect users from malicious extensions.
Should I trust high install counts?
Counts show popularity, not safety. This post draws no conclusion from them beyond that.
Sources
- Chrome Web Store program policies
- Add-on policies (Extension Workshop)
- Install and manage extensions (Chrome Web Store Help)
- Permissions list (Chrome for Developers)
- Install extensions alternative methods (Chrome for Developers)
Last reviewed: 19 October 2026.
