Browser extensions at work: a simple policy that keeps you safe

In October 2026 researchers revealed 319 fake Chrome extensions that had quietly routed millions of people's searches through their makers' servers. At home that is a privacy problem. At work it can be much worse: an extension that can "read and change data on all websites" can see web email, the CRM, the HR system and anything else staff open in the browser.

Why extensions are a blind spot

• Staff install them freely, often to save a few seconds on a task.
• They update automatically, so a safe extension today can be sold and turned malicious tomorrow.
• Many security tools focus on the device and the network, not on what runs inside the browser.

Step 1: find out what you have

Before writing any rules, take an inventory. Chrome Enterprise, Microsoft Edge management and most endpoint management tools can report every extension installed across your devices. In a very small business, simply ask everyone to open chrome://extensions or edge://extensions and send a screenshot. You will probably be surprised by the length of the list.

Step 2: decide on an approach

There are two common models:

1. Block list: allow everything except known bad or risky extensions. Easy to start, but always one step behind.
2. Allow list: block everything except extensions you have approved. More work at the start, far safer, and the right choice for most businesses that handle customer or financial data.

With an allow list, keep a simple request process: staff ask, someone checks the extension, and it is added if it is genuinely needed.

Step 3: how to judge an extension

• Permissions: does a PDF tool really need to read every website? Be wary of "read and change all your data".
• Publisher: is it from a known company with a real website and support contact?
• Purpose: can the job be done with a built-in feature or an approved app instead?
• Ownership changes: extensions that change owner are a common route for malicious updates. Re-check popular ones from time to time.

Step 4: enforce it centrally

Use browser policies, through Group Policy, Intune or your management console, to apply the allow list, block installation from outside the official store and force-install the few extensions everyone needs, such as your password manager. Central control also means you can remove a bad extension from every device in minutes.

Step 5: explain it to people

Rules that arrive without explanation get worked around. Tell staff why: extensions can see what they see, including customer data. Make requesting a new one quick and friendly. Our notes on security policies and phishing help with the awareness side.

A five-minute starting point

If you do nothing else this week: list your extensions, remove anything unused, and turn on your browser's enhanced safe browsing protection. Then put the allow list on your plan for next month.