Are Chess Extensions Safe? What Chrome Permissions Mean

Yes, most chess extensions are safe, provided you check two things before you click "Add to Chrome": which sites the extension can access, and what the developer says it does with your data. This guide explains Chrome's permission warnings in plain terms, using Google's own documentation, and applies them to real chess extensions.

We make ChessHelper (chesshelper.ai), an analysis extension for Chess.com and Lichess, so we have a stake in this topic. Everything below applies to our extension as much as to anyone else's, and the permission table near the end includes ChessHelper's own manifest.

What a chess extension can actually do

A Chrome extension is a small program that runs inside your browser. Chess extensions usually work in one of three ways. Some inject a script into Chess.com or Lichess pages to draw arrows, add buttons or read the moves of a finished game. Some open a new tab, such as the Lichess analysis board, and paste a game into it. A few run a chess engine like Stockfish inside the browser, so the analysis never leaves your computer.

Each of those abilities has to be declared in the extension's manifest file, and Chrome turns the risky ones into the warning you see at install time. That warning is the most useful safety information you get, so it pays to read it rather than click through it.

What "Read and change your data on chess.com" means

Chrome's documentation lists host warnings in the form "Read and change your data on HostName.com". For a chess extension that names chess.com, it means the extension can see and modify the pages you open on that site. In practice that covers the board, the move list, your username, the games list and chat, and anything you type on chess.com pages while the extension is active. It can also change what you see, for example by drawing an arrow or adding an "Analyze" button.

It does not let the extension read your bank, your email or any other site that is not on its list. That boundary is the whole point. Google's help page "Permissions requested by apps and extensions" puts "Your data on a list of websites" at a medium alert level and "Your data on all the websites you visit" at the same level but with a much wider reach, because an all-sites extension can read every page you open, including banking and social media.

So the warning is not a verdict. Google's page says plainly that a permission warning does not mean an extension is dangerous, only that it could be. A chess overlay has to read the chess page to work. The question is whether the list of sites matches the job.

Chrome permissions explained

Besides site access, extensions can request API permissions. The table below lists the ones you are most likely to meet on chess extensions, with the warning text from Google's permissions reference and what each one allows.

A permission with no warning is not automatically harmless, but it is limited. activeTab in particular is one Google's developer documentation recommends: it shows no warning and grants only temporary access to the site you are on, after you click the extension.

What real chess extensions ask for

We downloaded the published package of each extension on our ranked list on November 12, 2026 and read its manifest. None of them requests all-sites access, history, clipboard, management or debugger permissions.

Chessvision.ai shows a good pattern: it declares chess.com, lichess.org, youtube.com and x.com as optional, so it asks for each site only when you use it there. Google's help page notes that optional permissions can be allowed or denied after installation.

Red flags

These are the signs that should stop an install, or make you remove an extension you already have.

• Access to all websites for a one-site job. A tool that only works on Lichess has no reason to read every page you visit.
• Permissions unrelated to chess. History, clipboard, management and debugger have no place in a board overlay.
• A request for your Chess.com or Lichess password. Legitimate extensions read the page you are already logged into; they never need your credentials in a form of their own.
• "Undetectable" or "anti-ban" marketing. That language tells you the tool expects to be used during games against people, which breaks the rules of every major site. See our fair-play guide.
• No developer identity and no privacy disclosure. The Chrome Web Store shows the publisher, a contact email and a privacy section on every listing. Blank answers are a bad sign.
• A sudden new permission prompt after an update. When an update adds permissions that carry warnings, Chrome disables the extension until you approve them. Treat that prompt as a fresh install decision, because extensions are sometimes sold to new owners.
• Installs from a .zip file. A manually loaded ("unpacked") extension skips store review and does not update automatically. Prefer the store version when one exists.

How to audit an extension you already have

Open chrome://extensions in the address bar, or use the menu: More, then Extensions, then Manage Extensions. Click Details on the extension. The page shows its permissions and a Site access control. Google's help article "Install and manage extensions" describes the options: allow access only when you select the extension, on specific sites, or on all sites.

For a chess extension, "On specific sites" with only chess.com or lichess.org is the tightest setting that still lets most overlays work. Tools that work on click, such as the Chess.com-to-Lichess bridges, can run with access only when you select them. Our install guide walks through each setting in Chrome, Edge and Brave.

Then compare what you see with the store listing. If the listing says the extension only works on Lichess but Details shows access to all sites, ask the developer why or remove it.

How to remove an extension

Right-click the extension's icon to the right of the address bar and choose Remove from Chrome. If the icon is hidden, go to Manage Extensions, click Remove on the extension and confirm. In Microsoft Edge the option is called Remove from Microsoft Edge. Removing an extension deletes its local settings; if it had an online account, delete that separately on the developer's site.

If you suspect an extension misbehaved, also change your chess site password and sign out of other sessions from the site's security settings. That cuts off anything the extension might have read.

Safe software can still cost you your account

A clean permission list protects your browser, not your chess account. Chess.com's fair-play policy says not to use browser extensions or any tools that analyze positions during play, and Lichess prohibits external assistance while a game you are involved in is ongoing. An analysis extension that is perfectly safe to install can still get an account closed if it is switched on during a game against a person. The safe habit is simple: analyze after the game, on an analysis board, or against the computer.

Frequently asked questions