Chrome extension ownership change: how to catch a sold listing

The case everyone cites

The Great Suspender had about 2 million users, per the project's GitHub issue. Its original developer stepped back in June 2020. Version 7.1.8, released in October 2020, began contacting third-party servers and running code from them.

Microsoft removed it from Edge and Google later force-disabled it in Chrome.

The warning signs were public. A new owner, an unexplained update and a new domain showed up before the removals.

Signals of a Chrome extension ownership change

You can check these figures on the Privacy & Security category page, each with the day we saw it.

Our own false alarm

On 2 Oct 2026, the first day of our own crawl, our system flagged 33 publisher changes. One extension was even flagged twice. None were sales. We had compared publisher IDs from two different formats.

Never call a sale from the first day of tracking, or from one field. Our fix ignores that first day and only counts a change against an earlier crawl of our own.

A step-by-step check for one extension

When you suspect a sale, a short routine settles most cases in ten minutes. Run it once now and again in a week.

1. Open the store listingNote the publisher name, website and support email.
2. Compare with your notesor an older snapshot.
3. Open the privacy policyLook for a new company name or new data uses.
4. Check the permissionsin chrome://extensions under Details.
5. Read the last two update notes, if the developer posts them.
6. Search the extension's nameplus "sold" or "new owner" for any public statement.

If two or more of these changed, and the second check confirms it, a sale is likely. If only one changed, it may be a rebrand or a company restructure.

How common broad access is

Broad permissions are what make a sold extension risky. A tool with access to every site can do a lot in the wrong hands. In our crawl observed 3 Oct 2026, 11,272 of 65,655 extensions asked for access to all sites, and 4,776 asked for cookies.

An extension in this table that changes owner deserves a closer look than one that only stores settings. Our guide to permission changes covers what each one allows.

For teams that manage browsers

If you manage Chrome for a company, ownership changes belong in your review process.

• Keep an approved list with the publisher name and permissions at the time of approval.
• Re-review on any publisher or website change, not just on new permissions.
• Pin versions for critical tools where your setup allows it.
• Block high-risk permissions by default in your browser policy.

A quiet sale followed by a broad update can reach every managed browser in a day. A short list and a weekly check catch most of it.

For sellers: doing it cleanly

If you're the one selling, a few steps keep users' trust and keep you within the rules.

1. Tell users about the new owner in your update notes and on your website.
2. Ask for explicit consent before any user data moves, as Google's policy requires.
3. Check what the buyer plans to change, in writing.
4. Keep the privacy policy accurate on the day the sale closes.

Our guide to selling a Chrome extension covers the rest of the handover.

A short history of why this matters

Sold extensions have caused trouble often enough that browser makers and security teams watch for it. The Great Suspender is the best-known case, but the pattern is older and broader.

Not every sale follows this path. Most are fine. But the early steps are visible in public data, which is why tracking them is worth a few minutes.

Questions to ask a developer directly

If a tool you rely on seems to have changed hands, it's fair to ask. Many developers answer.

1. Has the extension been sold or transferred?
2. Who maintains it now?
3. Has the privacy policy changed, and why?
4. Why did the last update add new permissions?

A clear, quick answer is a good sign. Silence, or a vague reply, is a reason to switch to an alternative while you wait. You can find alternatives by job on our niche pages.

What we track and why

We're biased, since we build Ext Watch. For listings we crawl, we keep the publisher name, website and permissions per version, with the date we saw each one. After our own false alarm on day one, we only flag a change when two fields move and a later crawl confirms it.

That two-signal, two-check rule is worth copying even if you track by hand. It keeps you from raising alarms over a rebrand or a data quirk. Our extension pages show these fields for listings we've crawled.

What to do if a tool you use was sold

1. Check the listing's publisher name and website against your notes.
2. Read the current privacy policy for new data uses.
3. Look at what permissions the latest version requests.
4. If anything looks off, disable it and wait for clarity.

Google's program policies allow user data to move in a sale only after explicit prior consent from the user. A sudden policy rewrite after a sale deserves a careful read.

We're biased, but Ext Watch logs publisher and website fields over time with dates, and it now applies the two-crawl rule above. Pair it with a look at permission changes and automatic competitor tracking.

Write those five publisher names down today. A baseline makes any change obvious.