‘AI’ browser extensions: can they read your email, your files and your bank account?

The scenario in brief

Example, made up for illustration. In a fictional medical practice, the receptionist spends her mornings sorting emails from patients and laboratories. In her browser’s store she finds a free extension that promises to ‘summarise your emails with AI’. Thousands of reviews, a nice icon, an ‘Add’ button. A window pops up: the extension asks to read and change your data on all the websites you visit. She clicks, the way you click through terms and conditions.

From that moment on, the extension sees everything the receptionist sees in her browser: the mailbox, the online patient software, the bank’s website where she prepares payments. Nobody hacked anything. She simply handed over the key. If the extension is honest, it uses that access to summarise emails. If it is not, or if it changes hands tomorrow, those pages go somewhere else.

This scenario is not a case against AI: summarising, rewording, translating, these tools save real time. But an extension is not a website you visit: it is a small program installed inside the browser, right where your most sensitive data passes.

What an extension can see, depending on the access you give it

An extension is an add-on for your browser (Chrome, Edge, Firefox…) that gives it an extra feature: blocking adverts, translating a page, summarising a text. To work on a page, it has to be able to read it. Google explains this in its help page on extension permissions. When an extension asks for access to ‘your data on all the websites you visit’, it can read, request or change the data on every page you visit, your bank account, for example. A ‘summary’ AI extension often asks for this broad access, and may send the text it reads to an online server to process it.

These three settings exist in Chrome and Edge, and Google explains how to change them in a few clicks.

This is not theoretical: recent cases

Malicious extensions are nothing new. What is new is the ‘AI’ label, which attracts clicks, and the value of what people type into an AI assistant: work questions, client texts, sometimes patient data.

• In late December 2025, security researchers (OX Security) reported two extensions presented as an AI sidebar, with more than 900,000 users between them. One even carried the ‘Featured’ badge of Google’s store. They copied conversations with online AI assistants and the address of every open tab, then sent them to a server every 30 minutes. Yet they had asked for consent to collect ‘anonymous’ data.
• Also in December 2025, the specialist press (The Register) reported that a family of four free VPN extensions (tools that hide your internet connection) and ad blockers, installed more than 8 million times on Chrome and Edge, was capturing conversations with around ten AI assistants. The feature had been added in July 2025 through an automatic update: people who had installed the extension earlier never noticed a thing.
• In 2026, Microsoft published an analysis of a campaign involving 119 extensions posing as ad blockers, VPNs or translators, affecting around 2.6 million users. Among other things, they could steal Google account credentials while getting around two-factor authentication. All of them have been removed from the Edge store.
• In late December 2024, a perfectly legitimate security extension, used by around 400,000 people at work, was hijacked: attackers took control of its publisher’s account and published a modified version that went after passwords and open sessions, the ones that keep your accounts signed in (TechCrunch). It was removed the same day, but it had already installed itself automatically on users’ computers.

There are three lessons. A badge or thousands of reviews prove nothing. A good extension can turn bad overnight, through an update nobody sees. And ‘free’ often means your data is footing the bill.

Why it is more serious in a practice or an SME

At home, an overly curious extension sees online shopping, social media, a personal account. On a work computer, it sees the business mailbox, the patient or business software and the company bank account, sometimes right down to a patient’s record. Whatever the extension reads, it reads in your organisation’s name.

Health data is one of the special categories of data protected by Article 9 of the GDPR. If an extension has been able to read patients’ or clients’ personal data and send it elsewhere, that is a personal data breach under the GDPR. According to the Belgian Data Protection Authority (page in French), it must be notified without undue delay and, where possible, within 72 hours when it poses a risk to the people concerned.

A common trap is not the malicious extension. It is the honest extension, installed in good faith, that sends patient texts to a service whose terms nobody at the practice knows. As far as confidentiality goes, the result is the same.

How to choose an AI extension: six questions

Before adding anything to the browser on a work computer, ask these six questions. One wrong answer is enough to say no.

Limiting what an extension sees

Even a trusted extension has no need to read your bank account. Three settings cut the risk sharply, without installing anything else.

• Switch access to ‘on click’. In the browser’s extensions menu (the jigsaw-piece icon), choose ‘When you select the extension’ for each AI extension. It will then only read the page you launched it on.
• Turn extensions off on sensitive sites. Edge offers a per-site switch in the extensions menu that stops the extensions you installed from running on that site. Use it for the bank, the patient software and email.
• Keep uses apart. One browser profile with no extensions at all for banking and sensitive files. Another profile for everything else. It is simple, free and very effective.

In an organisation, the real protection is set once for every computer. In its documentation for businesses, Microsoft describes how to allow only a list of approved extensions, block those that ask for overly broad permissions and stop all extensions from reading certain sensitive sites. Your IT provider can put this in place without your staff losing the tools they need.

What to do on Monday morning

1. Take stock. On each computer, open the browser’s extensions page and note what is installed. You will probably be surprised.
2. Remove without hesitation any extension that is unknown, unused or that nobody can explain.
3. Switch the remaining extensions to ‘on click’ access, except those approved by your IT provider.
4. Write a one-line rule: no new extension without prior approval. Put it up where people see it, and explain why.
5. Create a ‘sensitive’ browser profile with no extensions, for banking and the patient or business software.
6. Repeat a simple rule: no patient, client or employee data in an AI tool that the practice or company has not approved.
7. Ask your IT provider for a list of allowed extensions, applied to every computer.

Allow a morning for a small practice. AI is still available, but it is no longer looking over everyone’s shoulder.

An extension may have seen too much: what now?

1. Remove the extension from every computer where it is installed.
2. Change the passwords of the accounts used while it was installed: email, bank, business software. Microsoft recommends this in its 2026 analysis for sensitive accounts such as email and banking.
3. Sign out everywhere (the ‘open sessions’ that keep your accounts signed in) and check recent account activity: unknown sign-ins, newly added email forwarding rules.
4. Assess what may have been read. Patients’ or clients’ personal data? Notify the Data Protection Authority if there is a risk, within 72 hours if possible.
5. Report the incident to the Centre for Cybersecurity Belgium, preferably through its online form, or to [email protected]. A suspicious message can be forwarded to [email protected].

AI has its place in a practice or an SME. It just has to come in through the door you chose, not through an extension added in two clicks one Tuesday morning.

Sort out your extensions→