This isn't about installing anything new. It's about the handful of default settings on the browser you already use, most of which most people have never opened.
1. Turn off saved autofill for sensitive fields
Chrome's autofill can store card numbers and addresses for convenience — useful, but risky on a shared or lost device. Go to Chrome → Settings → Autofill and passwords and review what's saved. If your phone isn't reliably locked with a PIN/biometric, consider turning off payment method autofill specifically.
2. Review site permissions
Over time, sites accumulate permissions — location, camera, microphone, notifications — that you approved once and forgot about. Go to Chrome → Settings → Site settings and scan through each permission category. Revoke access for anything you don't actively use; a shopping site rarely needs ongoing location access after checkout.
Notification permissions are one of the most abused categories — sites use them to send fake "security alert" or "your account has an issue" push notifications that look like they're from your phone's system, not the website, making them an effective phishing vector.
3. Clear third-party cookies periodically
Third-party cookies track your browsing across unrelated sites to build an advertising profile. Under Chrome → Settings → Privacy and security → Third-party cookies, you can block them entirely for most browsing without breaking site functionality for the vast majority of sites you use.
4. Check "Safe Browsing" is set to Enhanced
Under Privacy and security → Safe Browsing, Chrome offers Standard and Enhanced protection. Enhanced protection checks URLs against Google's threat database in real time before you load them, catching newly created phishing sites faster than Standard mode, at the cost of sharing more browsing data with Google — a reasonable trade-off for most people.
5. Review app permissions at the Android level, not just the browser
Go to Android Settings → Apps → Permission manager and check which apps have access to your camera, microphone, location, and contacts — not just the browser. Many apps request "always" location access when "only while using the app" would work identically; switching this reduces background tracking without breaking functionality.
6. Turn on "Find My Device"
Not strictly a browser setting, but the single highest-impact five-minute fix: enabling Find My Device (Settings → Google → Find My Device) means a lost or stolen phone can be remotely locked or wiped, protecting everything logged into your browser and apps if the device itself is lost.
- Site settings → revoke unused location/camera/mic/notification permissions
- Safe Browsing → set to Enhanced
- Android Permission manager → switch unnecessary "always" location access to "while using app"
- Confirm Find My Device is turned on