Browser Extension Policies
This feature requires Privilege Manager version 13.0.0 or newer.
Overview
Browser extensions expand the functionality of web browsers, but they also represent a growing attack surface.
Extensions can read and modify web page content, intercept network requests, access browsing history, and interact with credentials and authentication tokens. A single malicious or compromised extension can exfiltrate sensitive data, inject unwanted content, or provide a backdoor into corporate systems.
Privilege Manager gives administrators the tools to discover every browser extension installed across managed Windows and macOS endpoints, evaluate the risk each extension poses, and enforce policies that control which extensions are permitted to run.
Supported Browsers
| Browser | Inventory | Enforcement |
|---|---|---|
| Google Chrome | yes | yes |
| Microsoft Edge | yes | yes |
| Mozilla Firefox | yes | yes |
| Safari (MacOS-only) | yes | yes - best effort, deny-list only, see Building Browser Extension Policies (Safari) |
Browser Extension Management
Organizations typically have limited visibility into what browser extensions employees install. Unlike traditional applications that go through software distribution channels, browser extensions are installed directly by end users from browser-specific web stores, often without any approval process. This creates several challenges:
- Shadow IT - Users install extensions that IT has no knowledge of, creating blind spots in the security posture.
- Data leakage - Extensions with broad permissions can read data from any page a user visits, including internal applications, email, and financial systems.
- Supply chain risk - Legitimate extensions can be sold to new owners or compromised through developer account takeovers, silently turning trusted extensions into malware delivery vehicles.
- Compliance - Regulatory frameworks increasingly require organizations to demonstrate control over software running on endpoints, including browser extensions.
The Discover, Review, and Enforce Workflow
Browser extension management in Privilege Manager follows a three-phase workflow:
Phase 1: Discover
The first step is gaining visibility. Create a Browser Extension Inventory Policy and target it to one or more computer groups. Once deployed, the Privilege Manager agent on each endpoint scans browser profiles for all local users and reports every installed extension back to the server.
Results appear in the Browser Extension Inventory reports, giving you a fleet-wide picture of what extensions are in use. SeeBrowser Extension Inventories for more information.
Phase 2: Review
With inventory data flowing in, use the reports and extension detail views to evaluate what has been discovered. Privilege Manager provides risk scores, classification, and permission analysis to help you prioritize which extensions require attention.
The Browser Extension Inventory report surfaces the highest-risk extensions first, and the Extension Resource Detail view lets you inspect an individual extension's permissions, version history, and installation footprint across your environment. See Browser Extension Reports, Classification, and Risk Scoring for more information.
Phase 3: Enforce
After reviewing, create enforcement policies that define which extensions are allowed and which are blocked. Privilege Manager supports two enforcement modes:
- Allow List mode - Only explicitly approved extensions may be installed. All other extensions are blocked.
- Deny List mode - All extensions are permitted except those explicitly blocked.
Refer to the following instructions on creating and deploying enforcement policies:
