# Can a malicious add-on access internet history and such in Chrome/Firefox?

How does Chrome/Firefox make sure add-ons are safe? Do they have any protection against a malicious add-on?

How much access can add-ons have? Can they access internet history or maybe even cookies and such and send them to a server? Do I need to worry about this?

I do have Kaspersky and Kaspersky add-ons but I still wonder should I still worry about add-ons? Considering there is nothing I can do to make sure some add-ons are malicious or not even if they still have an OK reputation.

EDIT: bonus question, if an addon says it can read the data on websites you visit, does it mean it can know which websites I visit and technically can send them to a server and basically record my history this way ? (considering many adblockers and such addons have this permission)

Modern browser extensions use the WebExtensions API, which enforces a permission model; basically, addons can only have the access that you grant them (you can't reject individual permissions though; if you are uncomfortable with some, you can't install the addon).

• The browser history can only be requested if the history permission is granted.
• The cookies permission only works along with a host permission which will define which cookies can be accessed. Host permissions are required for all of the sensitive actions (such as injecting JavaScript into a page, reading the contents of a page, etc).

Malicious extensions can of course execute arbitrary JavaScript in an isolated context, so something like a malicious cryptominer is certainly feasible.

For access which doesn't require explicit permissions, see my related question: Danger of browser extension without any permissions?.

• Thanks for answer, so when you say if permission is granted, do you mean during installation I will be met with a "pop up" that asks me if I'm OK with granting that addon to my history? and if no such popup occurs then it means that addon has no access to history? (I'm asking this because I have never encountered with such popup during installation of my addons) – Mery Ted Mar 26 at 13:40
• also a bonus question if you have time to answer: what about sending the visited site url/content to their server immediately after visiting without accessing the history, is this possible for them? – Mery Ted Mar 26 at 13:47
• @MeryTed Exactly. It should ask during installation. Chrome eg uses a popup which says "Add [extension]? It can: [permissions; eg 'Read and change all your data on the websites you visit']", Firefox says "Add [extension]? It requires permission to: [...]". What browser are you using? – tim Mar 26 at 14:29
• @MeryTed If the permission to history and/or "access/read data on websites you visit" or similar isn't granted, extensions should imho have no primary way to see which websites you visit (there may be side-channels which leak this, but this probably wouldn't leak this to just extensions, but any website, see eg here; extensions may have a bit more options, so the possibility of such an issue may be a bit more likely as compared to websites). – tim Mar 26 at 14:30
• so if an addon says it can read data on websites I visit it means it knows which sites I visit and it could technically send it to their server and basically record my history this way? (for example Netcraft Extension addon) (I also use chrome mostly) – Mery Ted Mar 26 at 18:25

how does chrome/firefox make sure addons are safe?

They inspect them before publishing, and ban those found abusing its rights. But this ban can take from days to weeks.

how much access can addons have?

Addons can make anything you can, and more. They can access any server, read any cookie, alter any data, even encrypted by HTTPS, and send any data anywhere. They have to ask your permission when you install, but once you gave permission, for example, to read data on all websites, the addon can read data on all websites you visit.