How to Spot Fake Browser Extensions Before You Install Them
Fake and copycat browser extensions look almost identical to the real thing but can quietly steal your logins and browsing data. Here is a beginner-friendly checklist to vet any extension before you click Add.
Table of contents
Browser extensions are wonderfully useful, but they are also a favourite hiding place for bad software. A fake extension can look like a perfect copy of a popular tool — same name, same icon, same description — while quietly reading your passwords, hijacking your search results, or injecting ads and scam links into every page you visit. Because you willingly install it, it slips past a lot of defences.
The good news is that most fakes give themselves away if you slow down for sixty seconds and check a few things before clicking "Add" or "Install." Here is exactly what to look at.
Why fake extensions are so effective
An extension typically runs on the pages you visit and can, depending on its permissions, read and change what is on them. That is what lets a password-stealer or ad-injector do its work. Attackers get their fakes in front of you in a few predictable ways:
- Copycats in the official store that mimic a well-known extension's name and icon.
- Cloned tools with a tiny name change, hoping you will not notice.
- Fake "you need this plugin" prompts on shady websites that push you to install something to continue.
- Legitimate extensions that were sold or hijacked and then updated with malicious code.
Understanding the payoff for the attacker helps you stay alert: many of these extensions exist to harvest credentials, which then feed into the kind of stolen-data collections described in what are infostealer logs and why are they so dangerous.
The pre-install checklist
Run through these before you install anything. None of them takes long, and together they filter out the overwhelming majority of fakes.
1. Check the publisher, not just the name. Look at who actually published the extension. Is it the official company behind the tool, or a random developer name? Cross-check by starting from the product's real website and following its link to the extension, rather than searching the store and guessing which result is genuine.
2. Look at the number of users and the age of the listing. A widely used, well-established tool usually has a large user count and a long history. A brand-new listing claiming to be a famous product, with only a handful of users, is a warning sign. Attackers often spin up fresh copycats.
3. Read the reviews with a critical eye. Skim beyond the star rating. Look for recent reviews complaining about ads, redirects, or strange behaviour. Be suspicious of a flood of short, generic five-star reviews posted around the same time — that pattern is often faked.
4. Scrutinise the permissions. This is the big one. Before installing, the browser tells you what the extension can access. Ask whether the request fits the job:
- A dark-mode or theme extension does not need to read your data on your banking site.
- A unit converter does not need access to your browsing history or all websites.
- "Read and change all your data on all websites" is sometimes legitimate (an ad blocker genuinely needs broad access) but should always make you pause and ask why this particular tool needs it.
When the permissions are broader than the feature justifies, walk away.
5. Watch for spelling and polish. Copycats often have subtle misspellings in the name, a slightly-off icon, awkward grammar in the description, or a developer website that looks hastily built. Legitimate tools are usually polished and consistent.
6. Never install from a pop-up demand. If a website insists you must install an extension, codec, or "security plugin" to continue, close the tab. That is a classic malware delivery trick, not a real requirement. Only install from your browser's official store, and ideally only after arriving there from the product's genuine site.
A quick comparison
| Green flags | Red flags |
|---|---|
| Published by the real company | Unknown or generic developer name |
| Large, long-standing user base | Brand-new listing impersonating a famous tool |
| Detailed, specific, recent reviews | Bursts of identical five-star reviews |
| Permissions match the feature | Permissions far broader than needed |
| Polished name, icon, and site | Misspellings, off icon, sloppy description |
| You reached it from the real website | A pop-up demanded you install it |
After you install: stay tidy
Vetting does not end at installation, because a safe extension today can change hands and turn malicious later. Build two small habits:
- Review your extensions every few months. Remove anything you no longer use, and re-check the permissions of what remains.
- Watch for sudden new behaviour — unexpected ads, changed search engine, redirects, or a permission request that appears out of nowhere after an update. Any of these is a reason to disable the extension immediately.
If something does slip through and you suspect an extension has been misbehaving, remove it, change the passwords for anything sensitive you logged into while it was active, and work through the emergency checklist for after you click a bad link. It applies just as well to a bad extension as to a bad link.
The bottom line
A fake extension only works if you install it, which means you hold the deciding vote. Check the publisher, weigh the user count and reviews, and — above all — question permissions that are bigger than the job. Sixty seconds of scrutiny before you click "Add" is far cheaper than untangling a stolen password afterwards.
