Browser extensions request permissions when you install them, but most people click through without reading. The most common permission: 'Read and change all your data on websites you visit.' This means the extension sees everything. Every page. Every form field. Every password you type into any site.
Extensions have been caught injecting ads, stealing passwords, redirecting search results, and selling browsing history to data brokers — often years after the original developer sold the extension to a malicious buyer. The Chrome Web Store reviews are not reliable protection.
Open your browser's extension manager right now (Chrome: Menu u2192 Extensions u2192 Manage Extensions; Firefox: Menu u2192 Add-ons). Look at every extension you have installed. Ask for each one: Do I remember installing this? Do I still use it? Is it from a recognizable, trustworthy source?
Delete anything you don't recognize or haven't used in the last month. For anything you want to keep, check what permissions it has. An extension for grammar checking doesn't need access to 'All sites.' A coupon extension has no business reading your banking pages.
The only browser extensions worth the risk are those from established, auditable organizations: uBlock Origin, Privacy Badger, Bitwarden, 1Password, LastPass (the major password managers), and language tools from known companies. Everything else is a risk calculation.