15 AI Extensions, 59.5 Million Installs. The Chrome Web Store Published the Permissions for Exactly Zero of Them.

TL;DR: I fetched 30 Chrome Web Store listings on August 15, 2026 and confirmed 15 AI assistant extensions carrying 59,500,000 combined installs. The store published an install count, an update date and a data-collection declaration for all 15, and a permission scope for none of them: zero of the 21 listings that resolved rendered any permission text in the served page, across three locales. Four of the 15 declare they "will not collect or use your data," and two of those four are contradicted by the vendor's own privacy policy. To find out what an AI extension can reach, you have to leave the store listing entirely.

Agentic capability now ships as a browser extension. You click one dialog, and something with a language model behind it is sitting inside every page you load. The premise of this audit was that the Chrome Web Store makes that surface checkable without installing anything, because listings publish install counts, update dates, permission requirements and the developer's own data declarations. Two of those four turned out to be true.

I never installed any of these. Every figure below came from fetching the public detail page.

What did the listings actually publish?

Of 30 candidate extension IDs I probed, 21 returned a live listing and 15 of those were AI assistant or agent products. The other six resolved to unrelated software (a crypto wallet, a code search tool, an ad skipper and similar), because I was probing IDs rather than crawling a ranked list, and I am counting only the 15 I positively identified.

The 15, with install counts as the store displays them: Grammarly at 36,000,000, Sider at 5,000,000, QuillBot at 5,000,000, DeepL at 4,000,000, Monica at 3,000,000, then WebChatGPT, AIPRM, Wordtune and Scribe at 1,000,000 each, Merlin AI at 900,000, Jetwriter AI at 500,000, Perplexity AI Companion at 400,000, HARPA AI and Compose AI at 300,000 each, and Superpower for ChatGPT at 100,000. Total: 59,500,000.

Update dates were live and mostly recent. Ten of the 15 had been updated within the last six weeks, four of them on the day I ran this. Privacy policy URLs were present on 14 of 15 listings. Twelve of those 14 returned HTTP 200 to me; merlin.foyer.work and sider.ai returned 403, which is a fetcher artifact rather than evidence the policy is gone, and I am recording it as unverified rather than broken.

Why can't you read the permissions?

Because they are not in the page. This was supposed to be the core column of the audit, and it produced a null result so total that it became the finding.

Across all 21 resolved listings, the served HTML contained zero instances of permission language: no "read and change all your data on all websites," no equivalent phrasing, nothing. The word "permissions" appears 26 times in Grammarly's page as interface scaffolding with no permission actually named inside it. Suspecting a locale issue, I refetched the Perplexity listing under ?hl=en, ?hl=en-US and ?hl=de. All three returned zero permission strings.

So the store's most consequential field is rendered client side, after the fact, to a real browser. Install counts and data declarations survive a plain fetch. The answer to "what can this thing touch" does not. That asymmetry is the whole post: everything an extension wants you to see is in the document, and the thing you need to make a decision is not.

The fallback is the manifest, where a vendor publishes one. WebChatGPT's source repo carries its manifest.json, version 3.3.1, which declares "permissions": ["storage"] and "host_permissions": ["*://*/*"]. That second line is the broad host access the store listing would have described in a sentence, if the store listing had described it. Method matters here, so to be explicit: install counts, dates and declarations for all 15 rows came from the store listing, and the only permission scope in this post came from a public repo manifest, for one extension. I could not source the other 14.

Which declarations contradict the vendor's own policy?

Eleven of the 15 disclose that they collect data. Four declare the opposite, in the store's exact wording, that the developer "will not collect or use your data": HARPA AI, Perplexity AI Companion, WebChatGPT and Jetwriter AI. Those four carry 2,200,000 installs between them. I opened each vendor's own privacy policy to check.

Two of the four contradict themselves. HARPA AI's privacy policy states "we collect three types of data" and enumerates email address, first and last name, IP address, browser type and version, pages visited, timestamps and cookies, plus "processing textual data through Large Language Models and 3rd party AI services," with Google Analytics and Mixpanel named. Jetwriter AI's policy states "we collect names; email addresses; mailing addresses; billing addresses; contact preferences" and separately that it automatically collects "your IP address, browser and device characteristics, operating system, language preferences, referring URLs, device name, country, location."

One of the four holds up. WebChatGPT's policy says "we take your privacy seriously and do not collect any personal information" and describes no collection anywhere, which is consistent with its store declaration even though its manifest requests every host.

The fourth is unverifiable. The Perplexity AI Companion listing published no privacy policy URL for me to check against, only a support email.

So the honest count is two contradictions across 800,000 installs, one clean, one uncheckable. Smaller than the headline the premise wanted, and it is the number I found.

What about the 2023 listing?

The Perplexity AI Companion listing reads 400,000 users, 3.8 stars from 444 ratings, last updated October 12, 2023. I re-verified every one of those fields directly and they match exactly. It is the only listing in the sample last touched before 2025, sitting almost three years behind a company shipping an entire agentic browser.

That is worth knowing and it is not an accusation. A listing that has not moved means the listing has not moved. It does not mean the extension is abandoned, unsafe or unmaintained, and I have no evidence for any of those. Companies routinely leave a working utility alone while the team's attention is elsewhere. What the date tells you is that whatever the store says about this extension describes late 2023, which matters mainly because the store is also declining to tell you what it can reach.

What does this not prove?

Install counts are Google's rounded display figures, not real numbers, so 59,500,000 is a floor-ish approximation and should never be quoted to three significant figures. A declaration that contradicts a privacy policy is a documentation failure, not proof of exfiltration, and I tested no traffic. My 15 rows came from probed IDs, not from a ranked list of the true top 25, so this is a sample of large AI extensions rather than the largest ones. And a permission field that does not render to curl renders fine to a human in Chrome, which is the point: the data is public in the weakest possible sense.

The pattern is the same one that shows up whenever a platform lets vendors describe themselves, including what note-taking vendors put in their own terms of service. The disclosures that get published are the ones the publisher chose to make legible. Before you grant a new AI extension anything, open the manifest, not the listing.