Browser Extensions: The Business Security Risk Nobody Inventories
Most work now happens in a browser: email, Microsoft 365, the CRM, accounting, banking. Browser extensions sit inside all of it. An extension with permission to “read and change all your data on all websites” can see the pages your employees open, the messages they read, and the forms they fill in. Most businesses have no idea which extensions are installed, and that is the problem. Getting control takes an inventory, an approved list, and a policy that enforces it.
What extension permissions really mean
When an extension asks to read and change data on all websites, it means it can see and modify the content of every page in the browser. That is how ad blockers and password managers work, so it is not automatically malicious. But it also means a bad or compromised extension can capture what is typed into pages, copy what is displayed, insert fake content, or redirect you elsewhere. Fewer extensions with fewer permissions means less risk.
How good extensions go bad
- They get sold. Popular free extensions are bought by companies that monetize the users, sometimes by injecting ads or collecting browsing data.
- The developer gets phished. In late 2024, attackers phished the developers of a number of Chrome extensions, including one from the security company Cyberhaven, and pushed malicious updates designed to steal session data from business users.
- Updates are automatic. An extension that was safe when installed can turn malicious with an update nobody reviews.
- Some were malicious from the start, dressed up as PDF converters, coupon finders, free VPNs, or productivity tools.
How to manage extensions
- Take an inventory. Microsoft Intune, Chrome Enterprise, and Edge management can report which extensions are installed on company devices.
- Decide what is approved. The password manager, any tools a department truly needs, and little else.
- Enforce it with browser policy. Both Edge and Chrome support policies that allow only approved extensions and block the rest, and that force-install the ones everyone needs, such as the company password manager.
- Review on a schedule. Check the approved list every quarter, and remove anything that changed ownership, requested new permissions, or is no longer used.
- Separate work and personal browsing. A managed work browser profile keeps personal extensions and logins away from company accounts.
Signs an extension has gone bad
- New ads, pop-ups, or banners on sites that never had them.
- The default search engine or home page changed on its own.
- Searches or links redirect through unfamiliar sites.
- An extension suddenly asks for new permissions after an update.
- Unexpected sign-in prompts for Microsoft 365 or other business apps.
Any of these is worth a call to IT. Removing the extension is the start; because some malicious extensions steal session data, signed-in accounts may need their sessions revoked and passwords changed as well.
Extensions worth avoiding
Free VPN extensions, coupon and shopping helpers, “download any video” tools, and PDF converters top the list of extensions that collect more than they should. Most of what they do is available through safer approved tools, or simply is not needed for work.
The new wave: AI extensions
AI assistants that summarize pages, write replies, or read your email are popular and useful — and many work by sending page content to an outside service. That can include customer data, contracts, and internal email. Treat AI extensions like any other tool that handles company data: approve the ones that meet your requirements and block the rest. Your AI acceptable use policy should name them specifically.
Part of a bigger shadow IT picture
Extensions are one piece of shadow IT: technology adopted without anyone checking it. The fix is the same everywhere — make the approved option easy, explain why the rules exist, and enforce them with technology rather than reminders. Removing local admin rights helps too, since it stops users installing browsers and software that sit outside your policies; see why employees should not be admins.
Take control of the browser
Equal Tech Solutions’ cybersecurity services inventory browser extensions, set up approved lists, and enforce browser policies through managed IT for businesses across Cleveland, Chattanooga, and the Southeast. Contact us to find out what is running in your team’s browsers.