Report: out of 188,620 extensions available on the Chrome Web Store, ~50% have fewer than 16 installs and 87% have fewer than 1,000; only 13 have 10M+ users
Around 87% of all Google Chrome extensions have fewer than 1,000 installs. — There are 188,620 extensions available on the Chrome Web Store …
Context & Ripple Effects
This install-count census quantifies what the store's security coverage has implied all along: an ecosystem where attention concentrates in a tiny head. The Duo Security survey found 35.4% of extensions asking to read data on every site and 84.7% shipping no privacy policy — across a catalog this size, that means the review problem scales with the tail, not the hits.
The incidents since reinforce the skew: the 295-extension ad-injection cluster reached 80M+ users through exactly the kind of popular add-ons users actually install, while the Nacho Analytics leak showed even mid-tier extensions quietly exfiltrating credentials. A store where half the inventory has fewer than 16 installs is simultaneously a discovery failure for developers and a haystack for anyone auditing it.
First-order effects
- Roughly 94,000 extensions are functionally invisible — their developers get essentially no distribution from the store's search and ranking, while the 13 extensions above 10M users capture a share of installs the rest combined never approach.
- Google's moderation burden covers 188,620 items, but its removal actions — like the 500+ ad-fraud extensions purged earlier in 2020 — inevitably target the high-install head where abuse pays.
Second-order effects
- Security research follows the installs: audits like Duo's and Avast's concentrate on popular extensions, leaving the sub-1,000-install tail as a low-scrutiny zone where a malicious newcomer can sit unnoticed precisely because nobody is watching.
- For extension developers, the economics push toward bundling or acquisition by the few large players who already own distribution, thinning out independent alternatives at the top of the catalog.
Third-order effects
- If the pattern holds, the open-store model gives way to de facto curation: Google's policy levers — permission requirements, Manifest V2-style deprecations, review gates — matter more than raw listing counts, making 'open' ecosystems open in name only.
- Browser vendors become the effective gatekeepers of desktop software distribution via extensions, a concentration regulators and competitors will increasingly have to treat as a platform-power question rather than a storefront hygiene one.
The trend: Browser extension ecosystems are consolidating into a small vetted head plus an unmonitored long tail, shifting real distribution power from open listings to the platform owner's curation controls.