A Practical Security Framework for Evaluating Firefox Extensions

Browser extension security has gotten more attention lately, especially after several high-profile cases of extensions being sold to ad companies and secretly updated to inject ads or steal data.

If you install Firefox extensions, here's a practical security framework for evaluating them — not just "does it have good reviews" but "can I verify what it actually does."

The Permission Hierarchy

Firefox extension permissions exist on a spectrum:

Highest risk (avoid unless there's a strong reason):

• <all_urls> — access to every website you visit
• webRequest + blocking — can intercept and modify all network requests
• history — your complete browsing history

Medium risk (common for legitimate extensions):

• tabs — can see your tab URLs and titles
• storage — can store data locally
• cookies — can read/write cookies for specified sites

Low risk:

• notifications — can send desktop notifications
• alarms — can schedule background tasks
• No network permissions

Check permissions: about:addons → click any extension → "Permissions" tab.

The Open Source Test

For any extension that handles sensitive data (password manager, ad blocker, anything with <all_urls>), check if it's open source.

Search GitHub or the extension's website. If you can't find source code, that's a yellow flag — not automatic disqualification, but something to factor in.

For new tab extensions specifically, open source is a reasonable expectation since they don't need any special capability. A closed-source new tab extension with no explanation of why it's closed is suspicious.

The "What Does This Actually Need?" Test

For each extension you install, ask: does it actually need these permissions for what it claims to do?

Examples:

• A color picker that requests <all_urls> permission: suspicious (why does it need to run on all sites?)
• A password manager that requests <all_urls>: expected (it needs to inject into login pages)
• A new tab extension that requests tabs but no <all_urls>: reasonable (needs tab permission to replace the new tab page)

Weather & Clock Dashboard, for example, requests tabs (for the new tab API) and optionally location. It doesn't request access to all websites because it runs as a new tab replacement, not as a content script that runs on every page.

The Update History Test

If an extension is on GitHub, look at its commit history and release notes. Red flags:

• Long periods of inactivity followed by a sudden update
• New owner or changed repository
• Updates that add new permissions (especially network permissions)

Extensions acquired by companies sometimes have name changes + new permissions in the same update — that's when you re-evaluate.

Checking After Installation

Firefox's extension store shows you an extension's permissions before you install. But after installation, you can also audit:

1. about:addons → extension → Permissions
2. about:performance → check CPU/memory usage is reasonable for what the extension does
3. Browser console while visiting sites: look for unexpected network requests from extension scripts

A new tab extension that makes 30 network requests when you open a tab is worth investigating. One that makes 1-2 (to a weather API) is expected.

The Practical Recommendation

Most users don't need a security audit for every extension. The practical version:

1. Prefer extensions with AMO "Recommended" badge (manual review by Mozilla)
2. For anything with <all_urls>, prefer open source
3. Keep extension count low — each extension is an attack surface
4. Review your installed extensions every 3-6 months and remove anything you're not actively using

The security cost of an unused extension is real — it's code that runs on your browser regardless of whether you use it.