Half of Popular Chrome Extensions Can See Every Page You Visit

When you install a Chrome extension, the browser shows you what it is allowed to touch. One line in that list does more than any other: "Read and change all your data on all websites." In an extension's manifest that is the <all_urls> host permission, or an equivalent all-sites match pattern. It grants the extension the ability to read the content of every page you open and to modify it — on your bank, your email, your employer's internal tools, everywhere.

What that permission technically covers is broad. An extension with all-sites host access can read the text, links, and form fields on any page you load, inject or rewrite content in the page, and run its own code in the page's context. That is exactly what makes a grammar checker or a PDF converter useful, and it is also, in the abstract, a wide surface. The permission itself does not distinguish between the two — it is a capability the manifest declares, and the browser grants it once, for every site, at install time.

We counted how common that permission is among the extensions people actually install. Using Crawlora's Chrome Web Store dataset (chrome_extensions_v1, 314,807 active listings crawled in July 2026), we isolated the 1,776 extensions with 100,000 or more users — call these the popular set — and looked at two declared fields: whether the manifest requests broad host access (<all_urls> or an equivalent all-sites pattern), and whether the listing's own data-safety disclosure says it collects data. Both are self-declared: the manifest states the permission an extension asks for, and the data-safety section states what its developer says it collects. Neither is a measurement of runtime behavior. Together they describe what a popular extension is permitted and disclosed to do.

Half of the popular shelf can see every page

Of the 1,776 popular extensions, 885 request broad host access — 49.8%, or very close to half. Split those 885 by their data-collection disclosure and the picture sharpens:

Broad access + declares data collection394

Broad access, no declared collection491

No broad host access891

So among the extensions with real reach, broad page access is not an edge case. It is the majority position. And 394 of the 885 — the emphasized bar above — go one step further and declare in their data-safety section that they collect user data. The remaining 491 request the same broad reach over your pages but declare no collection.

That 491 is worth pausing on. These extensions ask for the ability to read and change every page you visit, yet their own data-safety disclosure reports no data collection. That is not a contradiction: broad host access is about what an extension can touch inside your browser to do its job, while the data-collection flag is about what it says it sends off your device. An extension can genuinely need to rewrite a page locally without ever transmitting anything. The two fields answer different questions, and reading them together is what tells you the shape of what you are granting.

The largest ones, and why each needs it

Here are the five most-installed extensions that both request broad host access and declare data collection, ranked by install count. The point of this list is not suspicion. Each of these tools needs to read or change the page to deliver the feature you installed it for.

Extension	Users	Why broad access is the price of the feature
Adobe Acrobat: PDF edit, convert, sign	318,000,000	Transforms page content into and out of PDF, so it reads the pages you convert.
Grammarly: AI Writing Assistant	35,000,000	Checks the text you type on any site, so it reads editable fields everywhere.
Honey: Automated Coupons & Rewards	12,000,000	Scans checkout pages for coupon codes, so it reads the stores you shop on.
MetaMask	12,000,000	Injects a crypto wallet into any dApp page, so it runs on every site.
Tampermonkey	11,000,000	Exists to run user scripts across sites, so all-sites access is its whole purpose.

The capability concentrates where the users are

Across the whole store, broad host access is a minority request. Of the 314,807 active listings, 49,257 (15.6%) request it, and 69,039 (21.9%) declare data collection. Among the popular 1,776, the broad-access share jumps to 49.8% — more than three times the store-wide rate.

That gap is the real finding. The permission that lets an extension read and change every page you visit is uncommon in the long tail of the store, but it is close to a coin flip among the extensions that have actually reached a hundred thousand or more people. Reach and page access travel together: the tools that do enough to earn a large install base tend to be the tools that need to touch the page, and the capability lands disproportionately on the extensions in the widest use.

The same directional pattern shows up in the data-collection flag, though less sharply. Store-wide, 21.9% of listings declare data collection; among the popular 1,776, the two capabilities overlap in the 394 extensions that both request broad access and declare collection. The extensions most people install are, on both measures, the ones that ask for more.

What to check before you install

The disclosures behind every number here are public, per-extension, and readable before you click Add. Two of them are worth a glance on any install:

• Requested host permissions. Chrome lists these on the install prompt and the store listing. "Read and change all your data on all websites" is the <all_urls> grant. Decide whether the feature you want genuinely requires it — for a PDF editor or a grammar checker it plausibly does; for a single-purpose tool that only acts on one site, all-sites access is worth a second look.
• The declared data-collection flag. The listing's data-safety section states whether the developer says it collects data. Broad page access plus declared collection is the combination held by the 394 extensions above.

You can look up any extension's requested permissions and its data-collection flag in Crawlora's Chrome Web Store dataset — pull a single listing at /datasets/chrome-extensions/items/{id}, or filter the whole store by permission to see every extension that requests broad host access.

Sources

Methodology

The universe is Crawlora's Chrome Web Store dataset (chrome_extensions_v1), 314,807 active listings crawled in July 2026. "Broad host access" means the extension's manifest requests <all_urls> or an equivalent all-sites host match pattern — the permission to read and modify any page. "Collects data" means the listing's own self-declared data-safety disclosure states that it collects user data. The popular set is the 1,776 listings with 100,000 or more users, using Chrome's bucketed install counts. Every count and percentage above is taken directly from these two declared fields; nothing is inferred from behavior. A declared capability describes what an extension is permitted to do, not what it does with that permission.

Audit any Chrome extension's access

Look up any extension's requested permissions, host access and declared data collection across 314,807 listings — or filter the whole store by permission. REST and MCP, 2,000 free credits a month, no card.

Explore the datasetRead the MCP docs