Your browser is the application you spend more time in than almost any other, and it’s the primary attack surface for web-based threats — phishing, drive-by malware downloads, tracking scripts, ad injection, and malicious extensions all work through the browser. Taking twenty minutes to secure your browser closes the most commonly exploited vulnerabilities without sacrificing usability or requiring technical expertise. We go deeper on the whole subject in our Complete Guide to Online Security and Privacy.
Three layers need attention: the browser’s own settings, the extensions installed in it, and — to a lesser degree — the choice of browser itself. This guide covers all three for Chrome, Firefox, and Edge.
Core security settings — where to start
Chrome:
- Settings → Privacy and security → Security → “Enhanced protection” (Safe Browsing) — real-time phishing and malware checking against Google’s threat database
- Settings → Privacy and security → Security → “Always use secure connections” (HTTPS-First) — upgrades HTTP requests to HTTPS automatically
- Settings → Privacy and security → Security → Use secure DNS → Cloudflare (1.1.1.1) — encrypts DNS queries
- Settings → Privacy and security → Cookies → “Block third-party cookies” — immediate tracking reduction
Firefox:
- Settings → Privacy & Security → Enhanced Tracking Protection → Strict — blocks known trackers, fingerprinters, cryptomining scripts, and cross-site tracking cookies simultaneously. Firefox’s Strict mode is more aggressive than Chrome’s default equivalent.
- Settings → Privacy & Security → DNS over HTTPS → Max Protection
- Settings → Privacy & Security → HTTPS-Only Mode → Enable in all windows
Edge:
- edge://settings/privacy → Tracking prevention → Strict
- Edge → Enhanced Secure DNS → select a provider
- edge://settings/content/cookies → Block third-party cookies
Browser comparison — security and privacy defaults
| Security feature | Chrome | Firefox | Edge |
| Tracking protection (built-in) | Basic (Privacy Sandbox) | Strict ETP — best built-in | Strict mode available |
| HTTPS upgrade | Settings toggle | HTTPS-Only Mode | Settings toggle |
| DNS over HTTPS | Settings (Secure DNS) | Settings (Max Protection) | Settings (Secure DNS) |
| Safe Browsing | Enhanced (Google database) | Google Safe Browsing via API | SmartScreen (Microsoft) |
| Privacy by default | Moderate | Best of the three | Moderate |
Firefox leads on default privacy settings, which means you reach a secure configuration with fewer manual changes than Chrome or Edge. All three browsers reach a comparable security level through settings adjustments and the same extension set. Edge’s SmartScreen integration with Windows security tools provides advantages for Windows-specific threat detection that Firefox doesn’t have by default.
Extension management — simultaneous tool and risk
Extensions are simultaneously one of the best tools for browser security and one of the most significant risks to it. A malicious extension has full access to everything you do in the browser — every page you visit, every form you fill, every password you type. Compromise can happen even after legitimate installation, when an extension is acquired by a company with different intentions and updated to include surveillance or malware.
The four extensions that provide the most security value with the lowest risk:
- uBlock Origin: the most trusted ad and content blocker — minimal permissions, open source, doesn’t monetise user data. Blocks tracking scripts, malicious ad networks, and known malware distribution domains simultaneously.
- Your password manager extension (Bitwarden, 1Password, etc.): provides autofill security that Chrome and Firefox’s built-in managers don’t — specifically, it refuses to autofill credentials on domains that don’t match the saved entry. This passive phishing protection is underappreciated: if the autofill doesn’t trigger on a site asking for your bank login, treat that as an immediate warning signal.
- Privacy Badger (EFF): learning-based tracker blocking that complements uBlock’s list-based approach by catching new trackers not yet in the blocklists.
- WebRTC Control (Chrome users behind a VPN): prevents WebRTC from exposing your real IP address, bypassing the VPN tunnel.
Beyond these four: every additional extension is a potential attack surface. Apply the minimum-permission principle — an extension requesting “Read and change all your data on websites you visit” has broader access than most functions justify. Don’t install an extension that requests more permission than its purpose requires.
The most common attack vector in 2025-2026 browser security: legitimate extensions being acquired by companies that push malicious updates. When an extension sends a notification about permission changes, review what changed. If an extension previously needing access to one site now wants access to all sites — decline the update and find an alternative.
Advanced: fingerprinting and data leaks
Standard browser settings address the most common threats. More sophisticated tracking bypasses cookie-blocking entirely through browser fingerprinting — using the combination of your browser version, screen resolution, fonts, timezone, and hardware to identify your device without any cookies. The EFF’s Cover Your Tracks tool at coveryourtracks.eff.org shows how unique your current browser fingerprint is.
For fingerprint resistance:
- Firefox with privacy.resistFingerprinting: in about:config, set privacy.resistFingerprinting to true. Reduces fingerprint uniqueness meaningfully.
- The Mullvad Browser: built on Firefox specifically to make all its users’ fingerprints identical — the strongest available fingerprint resistance for a daily-use browser without using Tor.
WebRTC leaks expose your real IP address even through a VPN because WebRTC makes direct connections that bypass the VPN tunnel. Test at browserleaks.com — your VPN IP should appear in all fields, not your real IP. To fix: disable WebRTC in Firefox (about:config → media.peerconnection.enabled → false) or install the WebRTC Control extension in Chrome.
Address and payment card autofill in the browser is a less-discussed exposure. Browser autofill can submit your home address to sites specifically designed to capture it through hidden form fields. To limit this: disable autofill for addresses and payment cards in browser settings (Chrome: Settings → Autofill and passwords → disable “Addresses and more” and “Payment methods”). Use your password manager’s built-in form fill feature instead — it requires active selection of which data to fill rather than passive automatic submission.
Disable the browser’s built-in password manager
Two password managers running simultaneously — the browser’s built-in and a third-party extension — create confusing double-save prompts and inconsistent autofill behaviour. If you’re using a dedicated password manager extension, disable the browser’s built-in:
- Chrome: Settings → Autofill and passwords → Google Password Manager → Settings → Offer to save passwords → Off
- Firefox: Settings → Privacy & Security → Saved logins → “Ask to save logins” → Off
- Edge: Settings → Passwords → Offer to save passwords → Off
Our guide on using a password manager covers this setup in full detail, and our guide on private browsing mode covers the complementary session isolation that private windows provide for individual sensitive browsing sessions. For the current status of uBlock Origin compatibility with Chrome’s Manifest V3 extension framework, the uBlock Origin GitHub repository tracks compatibility and provides the latest version for both Chromium and Firefox.
Ongoing maintenance
Securing a browser is not a one-time setup — three ongoing practices prevent the protections from eroding:
- Keep the browser updated. Chrome, Firefox, and Edge all provide automatic updates. Disabling automatic updates to avoid performance impacts during installation consistently produces negative security outcomes. A browser three versions behind the current release is likely running with published, actively exploited vulnerabilities that the update would have closed.
- Quarterly extension audit. Review all installed extensions, remove any not actively used, and check recent update history for any that requested expanded permissions. The quarterly review prevents the gradual accumulation of extension surface area that reduces security over time.
- Separate browsing contexts for different risk levels. Use one browser profile (or one browser) for personal accounts and financial sites, a different profile for general browsing and unfamiliar sites. Extensions in the general profile can’t access data in the financial profile. Chrome’s multi-profile system and Firefox’s Multi-Account Containers extension both provide this separation within a single browser installation.
The combination of Enhanced Safe Browsing (or Firefox Strict ETP), uBlock Origin, a dedicated password manager extension, HTTPS-First mode, and secure DNS covers the vast majority of web-based threats most users face. This configuration takes about twenty minutes to set up and requires only the quarterly maintenance check to maintain. The browser you spend hours in each day is worth twenty minutes of configuration to make significantly safer.
Content Security Policy and what it means for users
Content Security Policy (CSP) is a security feature that websites implement to control what content can load on their pages — preventing malicious scripts from running even if an attacker injects code into the page. You don’t configure CSP as a user (it’s the website’s responsibility), but you can check whether a site uses it when evaluating unfamiliar websites. In Chrome DevTools (F12) → Network → click the page’s HTML request → look for “content-security-policy” in the Response Headers tab. Its presence is a positive security signal; its absence on a financial or login-focused site is worth noting.
Browser choice for high-risk browsing contexts
For routine daily browsing: Firefox or Chrome with the settings in this guide reaches adequate security for most users. For specific high-risk contexts — investigative research, accessing sensitive information on untrusted networks, or anything where you need strong anonymity — consider:
- Tor Browser: routes traffic through multiple encrypted relays, provides strong fingerprint resistance, and prevents most network-level surveillance. Slower than regular browsers and incompatible with some sites. Not for everyday use, but the correct tool for high-anonymity needs.
- Mullvad Browser: Firefox-based, designed to standardise fingerprints across all users for tracking resistance without the speed penalty of Tor. Good for privacy-conscious daily use without Tor’s compatibility trade-offs.
- Brave: Chromium-based with aggressive built-in tracking protection, ad blocking, and fingerprint randomisation. Some users prefer its balance of Chrome compatibility and stronger-than-Chrome defaults.
The “most secure browser” question doesn’t have a universal answer — it depends on the threat model. For most users, the threat is tracking and credential theft rather than state-level surveillance. The settings in this guide applied to Chrome or Firefox address those threats adequately. For users facing more sophisticated threats: Mullvad Browser or Tor Browser provide qualitatively different protection levels for specific use cases.
Extension security from the Manifest V3 transition
Chrome’s Manifest V3 (MV3) is a significant change to how Chrome extensions work, phasing out the APIs that uBlock Origin and similar content blockers use for their most powerful filtering capabilities. The transition is ongoing as of 2026. For Chrome users: install uBlock Origin from its official source and check its compatibility status periodically — the Chrome version is receiving MV3 adaptations that preserve most (not all) of its previous functionality. Firefox, which maintains its own API implementation, is less affected by this transition — uBlock Origin on Firefox retains full filtering capability without the Chromium MV3 restrictions. For users who want the strongest possible content blocking: Firefox with uBlock Origin currently provides better protection than Chrome with uBlock Origin during this transitional period.
Security-conscious browser configuration in 2026 is more achievable than it’s ever been. The settings exist, the extensions are free, the documentation is good, and the process takes less than an hour. The gap between a default browser and a properly configured one represents a meaningful, measurable difference in exposure to phishing, tracking, and malware delivery — and closing that gap is entirely within reach for anyone willing to spend the time.
Hardening checklist — start to finish
| Setting / Extension | Chrome | Firefox | Edge | Impact |
| Enhanced Safe Browsing / Strict ETP | Settings → Security → Enhanced protection | Settings → Privacy → Strict | Settings → Tracking prevention → Strict | High — blocks known malicious sites and trackers |
| HTTPS-Only Mode | Settings → Security → Always use secure connections | Settings → HTTPS-Only Mode | Settings → Privacy → Enhance security online | Medium — prevents downgrade attacks |
| Secure DNS (DoH) | Settings → Security → Use secure DNS | Settings → DNS over HTTPS → Max | Settings → Secure DNS | Medium — prevents DNS surveillance |
| Block third-party cookies | Settings → Cookies → Block 3rd party | Enabled in Strict ETP | Settings → Cookies | High — reduces cross-site tracking |
| uBlock Origin | Chrome Web Store | Firefox Add-ons | Edge Add-ons | High — blocks ads, trackers, malware domains |
| Password manager extension | Chrome Web Store | Firefox Add-ons | Edge Add-ons | High — includes phishing detection via domain matching |
| Disable browser built-in password manager | Settings → Autofill → off | Settings → Saved logins → off | Settings → Passwords → off | Medium — prevents dual-manager conflicts |
| Disable address/payment card autofill | Settings → Autofill → disable both | Not applicable by default | Settings → Autofill → disable | Medium — prevents hidden field capture |
| WebRTC leak protection (VPN users) | WebRTC Control extension | about:config → media.peerconnection.enabled → false | Not applicable (Edge blocks WebRTC leaks) | High for VPN users — prevents IP exposure |
Work through this checklist top to bottom and the browser will be substantially more secure than its factory defaults across all three risk categories — tracking, phishing, and malware delivery. Each item is a five-minute change at most; the whole list takes under an hour. After completing it, the quarterly extension review is the only ongoing maintenance required. You might also run into Reset Chrome Settings Without Losing Data.
