What “Read and change all your data on all websites” means
“Read and change all your data on all websites” is the warning Chrome shows when an extension is allowed to run on every site you open. It describes what the extension could do, not what it does. Plenty of harmless extensions need it, so the useful question is whether you trust whoever makes it.
Chrome’s wording has shifted a little over the years. On an extension’s details page today it reads “Allow this extension to read and change all your data on websites you visit.” Both mean the same thing.
What the warning allows
To add or change anything on a page, an extension has to run inside that page. Once it is inside, it could in principle see what is on the page and alter it.
Chrome cannot tell an extension that adds one button from an extension that reads your email. Both run inside the page, so both get the same warning. The warning is honest about what is possible. It tells you nothing about intent.
Why so many extensions ask for it
Any extension that works on every site has to ask for every site. That includes:
- ad blockers
- password managers
- dark mode and reading tools
- spelling and grammar checkers
- anything that draws on top of the page, such as a virtual pet
For these, the warning is a sign of how they work, not a sign that something is wrong.
How to check an extension before you install it
- See who makes it. The store listing names the developer. Look for a real company or person, a website, and a way to contact them.
- Read the privacy section of the listing. Developers have to state what data their extension collects and what they use it for.
- Read the privacy policy. Look for a plain sentence about the pages you visit. Vague wording is a reason to walk away.
- Ask whether the access fits the job. A pet that walks along every page needs every page. A calculator does not.
- Look at the reviews and the last update. An extension nobody has touched in years deserves more caution.
How to limit an extension after you install it
You can narrow what an extension is allowed to do at any time.
- In Chrome, select the Extensions icon, which looks like a puzzle piece, then Manage extensions.
- On the extension, select Details.
- Next to “Allow this extension to read and change all your data on websites you visit,” choose the site access you want: only when you click the extension, only on sites you list, or on all sites.
Some extensions stop being useful when you limit them, because they can no longer appear on the sites you left out. And remove any extension you no longer use. That is the simplest protection there is.
What Pawsome Family does with this access
Pawsome Family is a Chrome extension that turns photos of your dog or cat into a small animated pet, like this example husky, that walks along the bottom of every tab. To appear on every tab, it has to run on every tab. That is why Chrome shows the warning when you add it.
Here is what it does with that access:
- It draws your pet. It adds one small animation to the bottom of the page and changes nothing else.
- It checks the site’s name against your hidden sites. If you have asked your pet to stay off a site, the extension needs to know which site this is. That list is kept in your browser only.
- It does not read your tabs. It never reads, records, or sends the pages you visit, their addresses, or their content. Our privacy policy says the same.
The only other things it asks Chrome for are storage, to remember your settings, and alarms, to run timers. Neither of those shows a warning.
If you would rather keep your pet off certain sites, you can hide them on any site from the Pawsome Family button in the toolbar. You can also limit site access in Chrome, as described above. Your pet then appears only where you allow it.
The same test applies to us as to anyone else. If an extension asks for more than its job needs, do not install it.