A browser extension with permission to read and change all your data on every website has roughly the same access to your activity as the browser itself. For individual users, that might be an acceptable tradeoff for a useful tool. For a business PC, it is an access level that deserves the same scrutiny as any other privileged software. This guide covers browser security best practices recommended by the Cybersecurity and Infrastructure Security Agency (CISA), including how to audit installed extensions, evaluate their permissions, and keep them under control.
Understand what permissions extensions actually request
When a browser extension is installed, it requests a set of permissions that define what it can access. Many users click through these prompts without reading them, but the permissions matter significantly. An extension with access to all data on all websites can observe every page a user visits, read form inputs, capture credentials, and intercept communications between the browser and web services. This level of access is not unusual for legitimate tools such as ad blockers and password managers, but it is also the level of access a malicious extension needs to do serious damage.
As part of any audit, open the browser’s extension management page and review the stated permissions for each installed extension. Extensions that request broader permissions than their stated function requires warrant closer scrutiny. A PDF viewer that requests access to read and change all data on all websites, for example, is asking for significantly more access than PDF viewers should need.
Identify extensions that are abandoned or no longer maintained
Software that is no longer actively maintained does not receive security updates. An extension that was secure when installed may develop unpatched vulnerabilities over time if its developer stops updating it. Worse, CISA and security researchers have documented cases where abandoned extensions are sold to new owners who convert them into adware or spyware, taking advantage of the existing install base and previously granted permissions.
Check the last update date for each extension installed on business devices. Extensions that have not been updated in a year or more, particularly those from developers who appear to have stopped maintaining them, should be evaluated for removal. You can usually find the last-updated date on the browser’s extension page or in the extension’s web store listing.
Watch for extensions with legitimate covers and hidden behavior
Not all problematic extensions are obviously malicious. Some legitimate ad blockers have been known to accept payments from advertisers to ensure those advertisers’ content bypasses the blocker, undermining the tool’s purpose. Others collect browsing data for commercial purposes that are disclosed deep in a terms-of-service document rather than clearly communicated during installation.
When evaluating extensions for business use, give preference to tools with a clear commercial model and a reputable developer, where the business relationship between developer and user is transparent. Free extensions with large install bases and no obvious revenue model are worth extra scrutiny: the data access they hold may itself be the product.
Build an allowlist and remove everything outside it
The most effective organizational control over browser extensions is an allowlist: a defined set of approved extensions that employees may install, managed through browser enterprise policy. Extensions outside the allowlist are blocked from installation. This approach is supported by Chrome, Edge, and Firefox through their respective enterprise management frameworks, and it is the control CISA recommends as the foundation of browser security management.
Building the allowlist requires reviewing which extensions current employees use, evaluating each for business justification and permission scope, and removing those that don’t meet the criteria. The process takes time but eliminates the need to reactively investigate individual extension incidents after the fact.
Schedule regular audits and enforce removal procedures
Browser extensions accumulate over time, particularly on devices where employees have administrator rights. A quarterly review of installed extensions across managed devices catches new installations that haven’t gone through the approval process, identifies newly abandoned extensions, and provides an opportunity to remove tools that are no longer actively used.
The removal process for extensions that don’t meet the allowlist standard should be documented and consistently applied. Extensions that hold sensitive permissions should be removed promptly rather than left in place pending review. Once an extension has collected data, removing it cannot undo that collection, so speed matters when a problematic tool is identified.
Managing browser extension risks across your organization requires the right policies and controls. Our team can help you assess your current exposure and implement security measures that fit your environment. Get in touch to get started.
