You cannot assume that an add-on is safe "because it's hosted in one of the official extension galleries".
In this answer, I start with the explanation of how extensions end up in the extension galleries for the popular browsers. At the end, I dedicate an extra section to Chrome.
How does an item get listed in the official stores?
- Anyone with Google Wallet can pay 5$ to upload up to 20 extensions/apps to the Chrome Web Store. Extensions with binary components (NPAPI) are always reviewed manually. Other extensions are only checked by Google's secret scanner, which may put an extension on hold ("Pending review") if needed. This scanner is not perfect: Two months ago, I found many malicious extensions that violate the Developer Program policies. (I've filed some Report abuse forms; some apps were taken down, others weren't even though they contained the same kind of adware).
- All Firefox add-ons on AMO are put in a review queue upon submission. All editors who review add-ons have to follow the guidelines as stated in Performing a review. Extension developers are supposed to follow these instructions.
- Safari extensions can be submitted to the Apple Extension gallery. Developers have to adhere to the requirements of this document pdf. After passing the review, the extension will be listed in the gallery. Apple does not host the extension files themselves. After passing review, the extension will receive a prominent location in the relatively quiet extension gallery. Upon click, the extension from an external location is immediately installed without confirmation.
- All extensions in Opera's extension gallery are manually reviewed. Extensions will only be listed if they pass review (acceptance criteria).
- Extensions and add-ons on IEGallery.com are manually reviewed. The review criteria are very vague though. Further, IE extensions are compiled code, so the reviewers can't even know for sure that the add-on is safe.
All of these four galleries support automatic updates of extensions. Unless stated otherwise, the updates will automatically be installed (unless turned off by the user).
Updates to Chrome extensions are automatically checked, sometimes followed by a manual review. When an extension requests more permissions, they're automatically disabled until a user confirms the new requirements. The developer documentation provides list of permission warnings and their meanings. Google has also created a page (with fewer details) to explain the warnings to users - see Permissions requested by apps and extensions.
Updates to Firefox add-ons are manually reviewed.
Updates to Opera extensions are manually reviewed. Opera abandoned their old extension ecosystem and switched to a Chromium-like extension API in Opera 15. Before Opera 15 (Opera 12.xx and earlier), updates were automatically installed. Starting from Opera 15, extensions are disabled when a new permission is added, just like Chromium (see this comment on Github).
Since Apple doesn't host the files themselves, updates to Safari extensions are not reviewed any more.
Internet Explorer extensions are not automatically updated, unless the developer has built this feature.
- Chrome extensions may contain external code.
- Safari extensions are hosted on servers not controlled by Apple, so the developer is free to include whatever they want.
- Internet Explorer extensions are generally closed-source compiled binaries, so developers can run whatever code they want.
Many extensions collect usage statistics without the user's consent. Chrome even offers a tutorial on setting up tracking in extensions...
Firefox and Opera are doing quite well with the security of their extension platform. I don't put as much trust in the Chrome web store, because it does not manually review all extensions.
The only way to be sure that an extension is safe is to review it yourself.
For this purpose, I've created the "Chrome extension source viewer" Chrome extension. This extension allows one to view the source code of an extension in the Chrome Web Store. It ships with a code beautifier to make it more readable.
The first place to look at it a file called
manifest.json, because it defines the capabilities of an extension. Do you see anything suspicious? For instance, does an extension which promises to add smileys to Facebook define a content script for
*://*/* (=match pattern for every page)? Don't install the extension.
Look at the list of files. Do you see a file called
analytics.js? Know that you're going be tracked. This is not necessarily wrong, but it's good to know. Look in the files for
_gaq.push, which is the standard way to use Google Analytics.
Final note: Do not blindly trust an extension because it has a high number of users. Look through recent reviews and look for any red flags. Ignore the usual trolling comments and "1 star - does not work!" (unless there are heaps of them), and focus on comments that raise concerns about privacy or security.