Detect when your installed Chrome extensions have changed owners
A new Chrome extension that alerts users when their installed extensions change owners is prompting wider scrutiny of the browser extension ecosystem. Commenters welcome tools that surface ownership and update changes but argue this should be built into browsers themselves, with automatic updates paused or re-approved after a handover to prevent enshittification, tracking, or malware. Others highlight limits of such tools—ownership can be transferred via whole-account sales, and the checker itself relies on an external extension-promotion service—underscoring how much trust and security risk is baked into modern browser add-ons.
Purpose and behavior of the extension
- Tool monitors installed Chrome extensions and alerts when the listed developer/owner changes.
- It self‑checks via
chrome.management.getAll()and runs an automated check about once an hour. - It cannot retroactively tell you about ownership changes from before installation.
- Several commenters argue this should be native browser functionality, ideally disabling or pausing an extension on ownership change and prompting the user.
Effectiveness and inherent limits
- Concern: by the time an ownership change is detected, a malicious auto‑update may already have run.
- Many real‑world takeovers reportedly happen via selling the entire developer account or credentials; this would not show up as an “owner change” in store metadata, so the tool can’t help there.
- Also raised: a malicious new owner could update this watcher itself, so you can’t rely on it as a final safeguard (“who watches the watcher?”).
Auto‑updates vs user control
- Long subthread debates whether automatic updates are a net positive.
- Pro‑auto‑update arguments: users rarely update manually; security fixes are missed; old versions become botnet fodder.
- Anti‑auto‑update arguments: vendors abuse updates to ship spyware, ads, or feature regressions; users lose control over their own machines; some want a “security‑only” update channel and opt‑out for feature changes.
- Firefox’s per‑extension auto‑update toggle and permission‑change prompts are cited as a better compromise.
Technical details and ambiguity
- Discussion of Chrome’s extension ID being derived from a keypair; confusion and disagreement over how private keys, IDs, and store signing actually work.
- Some note complex, coarse permissions around messaging and DevTools that force scary‑sounding prompts even for benign use.
Privacy and ExBoost backend
- The extension sends a list of installed extension IDs to an external API (ExtensionBoost) to resolve current developers, because Web Store scraping from within an extension is restricted.
- Some see this as a necessary tradeoff; others are uncomfortable with any third party learning their full extension list and suspect it could be used for ad/analytics purposes.
Broader ecosystem concerns and alternatives
- Multiple anecdotes of popular extensions attracting high‑value buyout offers, often assumed to be for later enshittification or malware.
- Suggestions: browser‑level policy to require explicit re‑approval on ownership change, slow‑roll or hold updates, or even “kill” an extension name for a period after transfer.
- Alternatives mentioned: limiting or avoiding extensions entirely, using userscripts (with caveats), Pi‑hole and built‑in blockers, or curated/reviewed extension programs (e.g., Firefox recommended list).