audit chrome extensions with <all_urls> access

that grammar extension can read your bank login

you know that extension you installed two years ago to check your spelling, or save you 10% at checkout, or turn youtube dark mode on? there's a decent chance it can see every single page you visit. not metaphorically. literally read the text, the form fields, your logged in session, all of it. and you probably forgot it was even installed.

this isn't a "chrome is broken" post. it's a "go check your own browser" post. takes five minutes, costs nothing, and it's one of the highest value audits you can do for your own privacy.

why this permission exists at all

browser extensions have to ask for permissions, just like phone apps do. some permissions are narrow, like "read this one site" or "see your bookmarks." but a lot of extensions ask for <all_urls>, which basically means "let me read and modify every webpage you load, on every site, forever." that's the permission a password manager needs to autofill your logins. it's also the permission a sketchy "pdf converter" extension doesn't need but asks for anyway, because broad access is useful to whoever controls the code, even if it's useless to you.

the problem isn't that the permission exists. it's that nobody audits who actually has it.

finding the extensions folder

every extension you install gets unpacked into a folder on your machine, and inside that folder is a file called manifest.json. that manifest is basically the extension's id card. it declares its name, version, and every permission it's requesting, including whether it wants <all_urls> or the modern equivalent, "host_permissions": ["<all_urls>"].

on a mac, chrome extensions live under:

~/Library/Application Support/Google/Chrome/Default/Extensions

on windows, it's usually:

%LOCALAPPDATA%\Google\Chrome\User Data\Default\Extensions

on linux:

~/.config/google-chrome/Default/Extensions

open that folder and just look. each subfolder is one extension, named by a long random id instead of its actual name, which is annoying but whatever. count them. most people are surprised they have 15 to 30 extensions sitting there, half of which they couldn't name from memory.

grepping for the scary permission

instead of opening every manifest by hand, you can search all of them at once for the permission that matters. on mac or linux, from inside the extensions folder, something like:

grep -r "all_urls" .

this walks every subfolder and every manifest file, and spits out a list of exactly which extensions are asking for universal page access. anything that shows up in that output is something that can see your banking site, your email, your work dashboard, anything you load in a tab, assuming it's running.

that doesn't automatically mean it's malicious. plenty of legitimate tools genuinely need that level of access to function. but it does mean every extension on that list deserves a second look, because it has the technical capability to do real damage if it ever goes bad.

the part people don't think about: ownership changes

here's the actual threat model, and it's not "this extension was malware on day one." it's that small, free extensions get built by an independent dev, get popular, and then get bought out. sometimes by an ad company, sometimes by someone shadier. the new owner pushes an update, chrome auto-installs it in the background, and now the extension that used to just block ads is quietly logging form data or injecting ads of its own. you never approved that, you just never uninstalled the old one.

this has happened to real, widely used extensions more than once. it's not a hypothetical.

the takeaway

go look at your extensions folder, grep the manifests for all_urls, and be honest about which ones you actually use versus which ones have just been sitting there collecting dust and permissions. uninstall anything you don't actively need, trust what's left, and set a reminder to repeat this check every few months, because the extension you trust today might be sold to someone else tomorrow. fewer extensions with broad access means a smaller blast radius if one of them ever turns on you.