Asked to Install a Proctoring Extension? What It Sees

Some hiring assessments will not start until you install a Chrome extension the vendor supplies. That extension can do three things worth knowing about before you accept: read and change pages on the sites its host permissions cover, observe which tabs you open, and — if it requests screen capture — record a screen, window, or tab that you select in Chrome's own picker. It cannot enumerate the programs running on your computer, and it cannot begin capturing without you choosing a surface.

Chrome tells you which of those apply in the install prompt, and the extension's Chrome Web Store listing adds the vendor's own data disclosures. Both are readable in about a minute. This guide explains what each permission actually grants, checked against Chrome's extension documentation and three live hiring-proctoring listings as of October 2026.

What the install prompt is telling you

Chrome generates the warning strings in the install dialog from the permissions declared in the extension's manifest. The mapping is published, so a permission can be translated back into a capability. These are the ones that show up in assessment extensions, with Chrome's own warning text as documented in its permissions reference:

The prompt is a floor, not a complete inventory. Chrome's reference lists several permissions that display no warning at all, including activeTab, scripting, cookies, idle, and system.display. That last one matters in an assessment context: an extension can read your display layout, including how many monitors you have, without that appearing in the dialog you approved. If you want the full list rather than the warned subset, the extension's listing and privacy policy are where to look.

Screen capture still routes through your choice

desktopCapture sounds like the end of the conversation. It is not, because the permission only lets the extension ask. Chrome's desktopCapture documentation describes chooseDesktopMedia as showing "desktop media picker UI with the specified set of sources," and if you decline, "the callback is called with an empty streamId." The extension requests which tabs of the picker appear — screen, window, tab, audio — and you select the surface.

That makes the picker the most consequential click in the whole setup flow. Choosing Entire screen hands over everything visible on that display for the duration: other applications, notification banners, a second browser window. Choosing a single window narrows the stream to that window's contents. Many assessments legitimately require the full screen and will say so; the point is that the scope is decided there, visibly, and not silently by the permission grant.

Host permissions decide where the extension is awake

An extension's host permissions determine which sites it can read and modify. A tightly scoped assessment extension is only active on the vendor's own domain. ProctorExam's support documentation is unusually specific about this, listing its manifest permissions as desktopCapture, activeTab, tabs, and contextMenus, with access limited to *.proctorexam.com, and stating that "all these permissions are only active if the *.proctorexam.com site is open."

A listing that instead reads "read and change all your data on all websites" is a different proposition, because the grant does not expire when the assessment ends. Google's documentation on managing extension access describes the three site-access settings — when you select the extension, on the current site, or on all sites — and they can be changed after install from the extension's Details page. Extensions are also off in private browsing unless you turn on "Allow in incognito."

The practical consequence: an extension installed for one assessment keeps whatever access you approved until you narrow it or remove it. Treat uninstalling it afterwards as part of the assessment, not as housekeeping.

Where an extension's ceiling is, and the permission that raises it

A browser extension lives inside the browser. It cannot walk your process table, read another application's memory, or inspect files you have not handed to the page — which is why the detection questions that come up around what interview websites can learn about your installed extensions have narrower answers than most candidates expect.

Two things change that ceiling. nativeMessaging lets an extension talk to a companion program installed separately on your machine, and the companion is an ordinary desktop application with ordinary operating-system access. And some vendors skip the extension entirely in favor of a lockdown client; the capability gap between a browser extension and an assessment that ships as a desktop application is large, and the install step is where you find out which one you are agreeing to. Honorlock, which moved into hiring assessments in 2026, ships both — its extension and its desktop app record different things, as covered in what Honorlock records in a hiring assessment.

Reading three live listings

These are vendor statements on vendor-controlled pages, not independent verification. Read as such, they are still the best pre-install evidence available.

GLIDER.ai Proctoring describes its purpose on its Chrome Web Store listing as an extension that "invigilates the candidate's session during the duration of the test," and discloses access to web history. Its privacy declarations certify that data is not sold to third parties outside approved use cases and is not used to determine creditworthiness.

HirePro Assessment states that it detects and disables other Chrome extensions during an assessment, and that the developer "will not collect or use your data." The first claim is informative beyond its wording: enumerating and disabling other extensions is what the management permission exists for, so the described behavior implies that permission regardless of how the listing summarizes it.

ProctorExam publishes its manifest permissions in its own support article, which is the most checkable form of disclosure in this group.

All three are shaped by a Chrome Web Store requirement rather than voluntary candor. Google's user data policy requires developers to complete a Privacy Practices declaration before publishing or updating an item, and to post a limited-use disclosure. That produces consistent fields to compare across vendors. It does not involve an audit of whether the declaration is accurate.

If your browser is managed, the prompt may never appear

On a company-managed browser, extensions can be installed by policy. Google's administrator documentation states that an admin "can automatically install (force-install) specific Chrome apps and extensions for users in your organization," and that "users can't remove items that are force-installed." An assessment extension pushed this way arrives without the dialog described above, and the permissions it holds are visible only on its Details page.

This is one more reason that taking an interview or an assessment on hardware you do not control is a different risk calculation — what a managed work laptop can see during an interview covers the rest of it.

A two-minute check before you start

1. Read the install dialog and note every warning line, especially "all websites" and "capture content of your screen."
2. Open the extension's Chrome Web Store listing and read the Privacy practices section and the stated purpose.
3. After installing, open chrome://extensions, choose Details, and confirm the site-access setting and the full permission list.
4. If the assessment runs in one site, set site access to that site rather than all sites.
5. When the picker appears, pick the narrowest surface the instructions actually require.
6. Remove the extension when the assessment is over, or install it in a separate Chrome profile you use only for assessments.

What this check cannot resolve

It tells you the capability, not the handling. Nothing in a permission list reveals how long the recording is retained, who reviews it, or what a flag does to your candidacy. It also does not survive updates cleanly: a permission added in an update that carries a warning requires your approval again, while one that carries no warning does not surface anywhere — which follows from how Chrome maps permissions to warnings, and is a reason to recheck the Details page rather than trusting the dialog you read in March.

Consent is the other open question. Being told to install monitoring software as a condition of a job application raises a question that varies by jurisdiction and employer, and this is a technical guide rather than legal advice.

Where a desktop assistant sits in this picture

Control is a desktop AI interview assistant for Windows and macOS, not a browser extension, so it is not inside the permission scope an assessment extension receives. Its site states that the overlay "stays out of supported screen captures" and is "absent from the shared screen and from recordings," tested against Zoom 6.16 and earlier and browser-based screen recording, as of September 2026.

The scope of that statement is the part worth holding onto. The same page lists what it does not cover, including Zoom builds newer than 6.16 and proctoring tools that install their own capture driver. An assessment that ships a capture driver, or a picker where you select Entire screen, sits outside what has been tested — and no behavior documented here should be read as a claim about what any proctoring system will or will not record. Candidates should also check the assessment's stated rules, which govern regardless of what any tool is technically capable of.

The short version

An assessment extension's power is bounded by three things you can read before you commit: its host permissions, its warned permission list, and the surface you choose in the capture picker. A narrowly scoped extension on one domain is a different object from one granted all websites plus native messaging, and the install prompt distinguishes them. Check the listing, narrow the site access, pick the smallest surface the instructions require, and remove it afterwards.

If the architectural version of the same question is what you are after — what a desktop application can and cannot do during a screen share — how Control handles capture and overlay behavior covers that layer in detail.