Extensions are the only software on your computer that updates itself, runs inside every page you open, and can read the fields where you type a card number. A dozen installed add-ons is normal. A dozen enabled ones is where browsers start to crawl and where hijacks hide for months.
Count processes, not toolbar icons
Chrome will tell you the truth. Open chrome://extensions and switch on Developer mode in the top right — a Memory usage box appears with a figure per extension. For CPU, press Shift+Esc for the browser’s own Task Manager, where each enabled extension has its own row and its own process. Fifteen add-ons can mean fifteen background processes and 400–700 MB of RAM before a single tab is open. If the machine was already slow, the fixes in speeding up a slow Windows PC will find the rest of the drag.
Firefox reports the same thing at about:performance and lists the enabled set at about:addons. Edge mirrors Chrome at edge://extensions. Safari is the outlier: Safari → Settings → Extensions, with permissions granted per website, so an extension can sit installed and do nothing until you allow it on a specific domain.
Read the permission line, then narrow it
Click Details on any extension and look for one sentence: “Read and change all your data on all websites”. A screenshot tool needs that on the page you are capturing; it does not need it on your bank. Chrome’s Site access dropdown fixes this without uninstalling anything — change On all sites to On click and the extension only wakes when you click its icon. Most tools behave identically and stop injecting scripts into every page load.
Google’s documentation on permission warnings spells out what each prompt actually grants, and it is worth reading once: “read your browsing history” and “manage your downloads” are different powers, and neither is decorative.
What a hijacked extension looks like
Four symptoms, in the order they usually appear. Your default search engine changes to something you never chose. The new tab page fills with a “news” grid. Adverts show up on sites that have never run adverts. And the extension’s store listing vanishes — open Details, follow the link to the Chrome Web Store, and if it reads “This item is not available”, the developer was removed for policy violations while the code stayed on your disk.
Check the listing before that happens: publisher name, user count, and the “last updated” date. An add-on with 3,000 users and no update in two years is a liability, and one that requests access to every site while offering a countdown timer is lying about what it does.
If the browser refuses to remove it, it was installed by policy. chrome://policy shows the enterprise rule that reinstalls it, which almost always means something dropped it there. Settings → Reset settings → Restore settings to their original defaults clears it while keeping bookmarks, history and saved passwords.
Set a cap and a review date
Chrome has moved to Manifest V3, the extension platform that replaced the old persistent background pages. Add-ons still built on V2 were switched off progressively through 2024 and 2025, which is why the full uBlock Origin stopped working in Chrome and uBlock Origin Lite exists. If something quietly died without an update, that is the cause rather than a bug in your machine.
A workable limit is eight: one password manager, one content blocker, one screenshot or annotation tool, and five you can justify out loud. Then book ten minutes every three months to open the list and delete anything you have not clicked since the last pass. The count creeps because installing takes two seconds while uninstalling requires remembering the thing exists. If a colleague or a YouTube tutorial asks you to load an extension from a .crx file or from “developer mode → Load unpacked”, decline — nothing in the Web Store needs that, and sideloaded code skips the review that gets malicious add-ons pulled. Mozilla’s own guidance on disabling or removing add-ons follows the same steps in Firefox if that is your browser.
Clearing cache and cookies is a separate job with a different risk profile — it signs you out everywhere — so keep the two tasks apart and finish the extension audit first, while you still know which add-on was responsible for the behaviour you were chasing. Cleaning browser cache without breaking your logins covers the second half when you get to it.