A Jira browser extension can do what you can do in Jira, so installing one means trusting its publisher and every update they ship. With access to atlassian.net, it can read what you can read and send requests using your session. Before installing, check the permissions it asks for, who publishes it, its privacy policy and whether your company allows it. Chrome reviews extensions, but it can miss things.
What an extension can do with your Jira
When you install an extension with access to atlassian.net, Chrome warns that it can read and change your data on those sites. That covers more than it sounds like:
- It can read what’s on the page. The part of an extension that runs on the page sees the work items, comments and names you see.
- It can act as you. Its requests to Jira run on the page, and your browser adds your session. It can reach anything your account can reach, including work you never opened.
- It can change things. With your session, it could post a comment or move a work item.
- It may be able to send what it reads elsewhere. Access to atlassian.net controls where it runs. I found no Chrome rule that stops it sending that data to its own server.
Its access can’t exceed yours, because Jira still applies your permissions. The browser hides some login cookies from page scripts but still sends them with each request. Reading cookies takes a separate permission. Chrome shows no warning for it, so you may not see it when you install. Ask the developer, or ask someone technical to read the extension’s manifest file.
Your session can last a long time: Atlassian’s idle session default is 30 days unless your admin changes it. So the extension works whenever you’re signed in, and you may not notice what it does.
What to check before installing
| Check | Where to look | What you want to see |
|---|---|---|
| Permissions | Where: Open the listing or Chrome’s extension details | Good sign: Access limited to atlassian.net, not all websites |
| Publisher | Where: The name, website and contact on the listing | Good sign: A real person or company you can identify |
| Privacy policy | Where: The policy linked from the listing | Good sign: Plain statements about where data goes, including any servers |
| Purpose | Where: What the extension says it does | Good sign: Permissions that fit its job. A tool that only opens work items has no reason to ask for all websites |
| Recent history | Where: Last updated date and recent reviews | Good sign: No recent complaints about ads, redirects or a new owner |
| Your company’s rules | Where: chrome://policy, or ask IT | Good sign: IT’s approval, if your browser is managed |
How to limit one you’ve installed
- In Chrome, open the three-dot menu, then Extensions > Manage Extensions.
- Select Details on the extension.
- Find Site access and limit it. Depending on your Chrome version, you can restrict it to specific sites or to when you click it.
Limit it to your Jira site, such as yoursite.atlassian.net, and it can’t run on other companies’ Atlassian sites. Confluence on the same address stays in reach. Remove extensions you no longer use.
Developers can open DevTools on a Jira tab and watch the Network panel, and inspect the extension’s service worker if it has one. Cascade has none. This shows only the version you have, while the panel is open.
What Chrome’s review covers
Chrome reviews extensions with automated and manual checks, and rechecks them later. Under Manifest V3, an extension can’t download and run code from elsewhere. Its code has to ship in the package Chrome reviews.
- Privacy labels are declarations. The privacy practices section shows what the developer has disclosed. I found no Google page saying each one is verified.
- Updates install on their own. Chrome may pause an extension if an update adds a permission with a new warning. That covers new permissions only, and it says nothing about what the code does with permissions it already has.
- Good extensions can be taken over. In December 2024, attackers phished the developer of Cyberhaven’s extension, and more than 35 extensions were hijacked in the wider campaign.
I found no Google rule that says users must be told when an extension is sold, so look at its publisher and recent reviews from time to time.
If you need IT to approve it
Your IT team can block, allow or force-install extensions through Chrome policy, and limit which sites each one can touch. Type chrome://policy in the address bar to see what applies to you, and check Chrome’s managed browser help.
Atlassian’s app controls cover connected apps. That page doesn’t mention browser extensions, and I found no Atlassian guidance on them, so your Jira admin may not see one in use. Tell IT what you plan to install: the extension name and ID, its publisher, its permissions, its privacy policy, and what it does for you.
What Cascade does
I make Cascade, so here’s the same check run on it, including the parts that don’t help my case. I read this from the source code of version 0.9.3. Check the store shows that version or later.
- Permissions:
storage, which keeps data in your browser, and access to atlassian.net sites. It has no cookies permission. It also loads on Confluence pages on atlassian.net. - Data requests: they go to your own Jira site, with your session. There’s no Cascade server, and the extension has no analytics or tracking, so nothing reaches me.
- Requests that do leave your Jira site: file previews can redirect to Atlassian’s file servers. Avatars load from the address Jira gives, which can be Gravatar. Images in a work item load from wherever they’re hosted, and that host sees your IP address, as it would in Jira.
- What it stores: cached work items, your Inbox, saved views and settings stay in your browser. Some cached data can remain after you uninstall. One value, the date it first ran, can sync to your Google account through Chrome.
- What it changes in Jira: only what you ask for, such as a status, assignee, comment or watch.
- The trust you’re placing: Cascade is one person’s work, with few users. It can act as you, like any extension here.
The privacy policy has the full detail. If you need IT’s approval, my guide to getting a tree view without admin rights includes a note you can send them.
Cascade has no server and adds no analytics. Run the checks above on it, then install it and click the Cascade button on the right edge of Jira.
Add to Chrome (Chrome Web Store, opens in a new tab)Cascade runs in Chrome on a computer.Jira extension safety FAQ
Can a Chrome extension read my Jira data?
Yes, if it has access to your Jira site. It can read the pages you open and send requests with your signed-in session, so it can reach anything your Jira account can reach.
Can a Jira extension see my password?
Not on the sign-in page, if its access stops at atlassian.net, because you type your password on id.atlassian.com. It can still act as you while you’re signed in.
Does the Chrome Web Store check extensions?
Chrome reviews extensions with automated and manual checks, and rechecks them over time. The privacy section of a listing shows what the developer declares. I found no Google page saying that each declaration is verified.
Is a Marketplace app safer than a browser extension?
Neither is automatically safer. A site admin usually approves a Marketplace app, and it’s limited to the access it declares. An extension gets one person’s access, and your Jira admin may not know about it. I found no Atlassian guidance on browser extensions.
Does Cascade send my Jira data anywhere?
Cascade has no server, and I receive nothing from it. Its data requests go to your own Jira site. Images load from wherever Jira points to them, as they do in Jira, which can include Atlassian’s file servers and Gravatar.
I’m Ahmad Fiaz Jan, and I build Cascade for Jira on my own. I write these guides from Atlassian’s own documentation and link every source. More about me at ahmadfiaz.me and on LinkedIn.