Every extension gets read access to the pages you allow it on, runs code on every load, and can change owners without telling you. That combination means the bar for installing one should be high. These categories no longer clear it.
Chrome's Manifest V3 removed the blocking webRequest API and replaced it with declarativeNetRequest, which caps how many filter rules an extension can apply and prevents dynamic filtering. The practical result is that content blocking on Chrome is meaningfully weaker than it was, and "Lite" versions of blockers are a genuine downgrade rather than a rename. Firefox still supports the full API. If content blocking matters to you, that is now a browser choice more than an extension choice — or move blocking to the network layer with a DNS-level filter, which covers every device on the connection and cannot be starved by a manifest version.
These see every page you shop on and, more importantly, rewrite affiliate parameters at checkout. That is the actual business model: the coupon search is the visible part, and attribution hijacking is where the revenue comes from. Independent of the ethics, they are a permanent read-and-modify permission over your commerce sessions in exchange for discounts you can find with one search. Look up codes manually when you are actually buying something.
Chrome and Firefox both capture full-page screenshots natively: open DevTools, press Ctrl/Cmd+Shift+P, and run "Capture full size screenshot". Firefox has it in the right-click menu. Printing to PDF is in the print dialog. These extensions are the single most common vector for permission creep, because the category is popular, the code is trivial, and the extensions are cheap for someone to buy from an original developer who has lost interest.
The built-in browser password manager is fine for low-value logins and poor as a primary store: it is tied to one browser profile, exports awkwardly, and its sharing and recovery stories are weak. A dedicated manager with its own extension is a real tool. The overrated middle ground is the third or fourth "password saver" extension with 40,000 users and no published audit — the whole category is one where obscurity is a disqualification, not a feature.
Most of what these do is now native. Chrome has tab groups that persist and sync, plus a memory saver that discards inactive tabs; Firefox has containers, which do something no extension can — separate cookie jars per context, so a work account and a personal account can be logged in simultaneously. A tab manager that keeps a background index of every tab you have open is a heavy permission for a feature you may already have.
A browser VPN extension is a proxy for browser traffic only. It does not protect anything else on the machine, and free ones have a documented history of monetising the traffic they carry. If you need a VPN, use a system-level client from a provider with a published audit and a business model you can identify. If you only want to hide your IP from a website, that is a much narrower problem than what these extensions imply they solve.
Open chrome://extensions or about:addons and check three things per extension. What sites can it read — change "on all sites" to "on click" wherever the extension still works that way, which is most of them. When was it last updated — abandoned code accumulates vulnerabilities. And does it still do something you cannot do natively? Then open the browser's task manager (Shift+Esc in Chrome) and sort by memory; extensions frequently outweigh the pages you are actually reading. Uninstall anything you cannot justify in one sentence.