Browser extensions that change how you read

The most consequential sentence in any extension listing is the one nobody reads, in grey, under the install button: it can read and change all your data on all the websites you visit. For chrome extensions for reading this is not a red flag — it is mostly how the useful ones have to work. Which is exactly why it deserves five minutes of adult attention before you click.

The family is large and genuinely useful. Reader modes strip a cluttered page to its text and republish it in clean type. Bolding overlays in the Bionic Reading style embolden the front of every word — a technique we examine on its own terms in the bold prefix family. Read-aloud extensions turn any page into speech. Dictionary popovers define the word under your cursor. Each one changes reading at the moment it happens, on the page you are already on, which is a position no app outside the browser can occupy.

Search for a reading browser extension and the results sort into those four families plus a fifth, quieter one: the annotators and highlighters that save passages for later. What they share is the browser itself as the venue. Reading on the web mostly happens inside pages other people control, styled for engagement rather than legibility, and the extension is the only kind of tool that can intervene there — which is both its whole value and its whole risk.

That position has a technical price. To restyle an article, an extension must inject its own code into the page; to bold the first half of every word, it must first read every word; to speak a page aloud, likewise. The browser’s permission model tells the truth about this: a tool that transforms arbitrary pages needs access to arbitrary pages. The alarming sentence under the install button is not an admission of bad intent. It is an accurate description of how the feature is possible at all.

What the permission actually grants

Concretely: an extension with access to all sites can run its code on your banking session, your webmail, your medical portal, your employer’s admin console — every tab, every page, including the text you type. It can, in principle, send any of it anywhere. Almost none do. But “almost none” is doing heavy lifting in that sentence, because from the outside a well-behaved extension and a harvesting one present identically: same listing, same permission, same install flow. The permission tells you what is possible, never what is happening.

Two failure modes are worth knowing by name, and neither requires a villain at the start. Extensions get sold — a beloved tool changes hands quietly, and the new owner monetises the installed base with tracking the original author would never have shipped. And extensions get compromised — a hijacked developer account pushes a poisoned update to users who never look at the thing again after installing. Both patterns have recurred across the extension ecosystem for years. Auto-update, the feature that keeps tools fresh, is also the channel that makes yesterday’s audit obsolete.

Store review helps less than people assume. The stores scan for known malware patterns and police the worst permission abuses, but they cannot read intent, they cannot audit a server an extension talks to, and a compromised update ships through the same pipe as a legitimate one. Review is a filter, not a verdict. The remaining distance has to be covered by the person doing the installing, which is you, which is why the checklist below exists.

How to judge one honestly

• Match permissions to function. A dictionary popover needs the current page, not your browsing history. When the ask outruns the feature, that gap is the question to answer before installing.
• Prefer on-click access. Browsers now let you restrict most extensions to “when I click it”. A reading tool honestly built can usually live with that; one that resists it should say why.
• Open the network panel. Trigger the extension on a private-ish page and watch what leaves. Text going to a server is not automatically damning — cloud voices need it — but you should know, and the listing rarely says.
• Ask what pays for it. Free, closed-source, no visible business model, broad permissions: that combination has an odour history justifies. A price, a licence, or open code each answers the question a different way.
• Check the source if you can. Open code is not a guarantee — you are trusting that the store build matches the repository — but it moves trust from a promise to something inspectable.

The permission tells you what is possible. It never tells you what is happening.

The store page, stated plainly

Our extension, same standard

We ship a Chrome extension, and it does not get to skip this test because we wrote it. What it does: lifts the text of the page you are on — or just your selection — into the same single-word reader as the app, running on your machine. What it asks for, and why: by default it uses the browser’s activeTab grant, which means it can touch a page only on the tab where you invoke it, at the moment you invoke it, and holds no standing access to anything. Reading any page by keyboard shortcut does require the broad all-sites permission — so that is optional, off by default, and yours to refuse.

One network dependency survives, and honesty requires naming it. When a word falls through to the icon library — the fourth of the five resolver tiers — the icon is fetched from a single icon service, then cached so it is never fetched again. That request necessarily reveals to that service which icon names were asked for. The text you read is never sent anywhere; no account exists; nothing else leaves the machine. But “nothing leaves the machine” with an asterisk is exactly the kind of sentence this article says you should press on, so we are pressing on it in print.

For completeness, what it does not ask for: no browsing history, no tabs beyond the one you invoke it on, no cookies, no account, and your settings live in the browser’s ordinary extension storage rather than anywhere of ours. The icon-service grant is pinned to that one host. If a future version ever asks for more, the browser will tell you before we can — the one part of this system where the incentives point the right way by construction.

The reader-mode question

It is fair to ask whether you need an extension at all. Browsers ship a built-in reader mode; some now include read-aloud. The built-ins have the advantage of answering to the browser’s own scrutiny rather than a third party’s, and where one covers your need, it is the lower-trust path — lower-trust in the good sense of needing less of yours. Extensions earn their place where the built-ins stop: real typographic control, presentation the browser would never ship, a voice you choose, or in our case a way of reading the page was never designed for.

The uncomfortable summary is that the browser extension is the most powerful reading technology most people install and the least examined. The power is real — nothing else can meet your reading where it actually happens — and the examination costs one look at a permissions sheet and one look at a network panel. The field would improve quickly if reviews performed both looks as routinely as they screenshot the settings page. Until then, perform them yourself, on everything, including us.