Browser Extension Reports, Classification, and Risk Scoring
Overview
Once extensions have been inventoried, Privilege Manager helps you make sense of them. This page covers the reports that surface discovered extensions across your managed Windows and macOS workstations, and the classification and risk scoring the server applies to each one.
When the server processes a discovered Chrome, Edge, or Firefox extension, it fetches the extension's manifest, flags whether the extension is AI-related (based on a curated list of known AI extensions, AI service domains, and keyword patterns), and computes a risk score from the permissions it requests, how broadly it can access websites, and how it was installed.
The score is then rolled up into a Low, Medium, High, or Critical rating. The built-in Browser Extension reports let you review these results fleet-wide, you can then drill into any extension's requested permissions and per-user install footprint and prioritize which extensions to allow or block.
Safari extensions are inventoried and appear in the reports but are not classified or risk scored.
Viewing Inventory Results Across the Workstation Fleet
Procedure
Once agents have reported extension data, you can review the results in the extension inventory reports:
- Navigate to the global search, enter “Browser Extension Inventory”
- Locate and select the Browser Extension Inventory report
The Browser Extension Inventory report shows one row per unique extension resource, identified by the composite (Source, Browser, StoreId/BundleId) key, and is sorted by Risk Score in descending order by default. This gives you immediate visibility into the highest-risk extensions across your environment.
Clicking one of the rows takes you to a drill-down report called Computers with Browser Extension, this shows all the computers where the extension has been inventoried. Clicking the Browser Extension Name takes you to the extension resource itself.
Some extensions shown in the report are pre-populated by Delinea and may not actually be present in your workstation fleet. To see the extensions which are present on your workstations on a per-machine, per-user view, use the Browser Extensions by Computer report in the Reports > Detection section.
Troubleshooting
If extensions are not appearing in reports after enabling the inventory policy, verify the following:
- The pre-staged Browser Extension Inventory Policy is Enabled (it is disabled by default).
- The policy is targeted to the computer group that contains your workstations. By default it targets Windows Computers or MacOS Computers. Make sure your workstations are members of that group or of whatever group you retargeted the policy to.
- Agents in the targeted computer group have checked in recently. You can verify agent status on the individual computer resource pages.
- Enough time has elapsed for the agent to run the policy. If you enabled the policy mid-week, existing agents will not run it until their on-registration trigger fires (at next agent registration) or the next Wednesday weekly window, whichever comes first. If you need immediate results, use the standard scheduled-job controls to run the policy on demand on a specific workstation.
Extension Resource Detail View
Clicking an extension name in the Browser Extension Inventory report opens the Extension Resource Detail View. This view provides comprehensive information about a single extension resource. Each tab presents a different aspect of the extension's data.
Safari extensions have minimal information compared to Chrome, Edge, and Firefox extensions. For more information, see What the Agent collects.
Details Tab
AI Classification, Author, Description, Homepage Url, Manifest Version, Name, Risk Level, Risk Score, Version
Identity Tab
Browser, Source, StoreId/BundleId
Permissions tab
Permission, Permission Type
AI Classification
Browser Extension Manager automatically identifies browser extensions that use artificial intelligence capabilities. As AI-powered extensions proliferate, organizations need visibility into which extensions are sending data to AI services, generating content, or integrating with large language models. The AI detection system classifies extensions into two tiers based on the confidence of the detection.
Two-Tier Classification
Every extension that Browser Extension Manager identifies as AI-related receives one of two classification levels:
- Confirmed: The extension appears on a curated list of known AI extensions maintained by Delinea. These extensions have been individually reviewed and verified as AI-powered.
- Suspected: The extension was not found on the curated list but triggered one or more heuristic signals that indicate AI involvement. Suspected extensions have not been individually verified by Delinea and may include false positives.
Confirmed
A Confirmed classification means the extension appears on a curated list of known AI extensions maintained by Delinea. These extensions have been individually reviewed and verified as AI-powered.
The curated list includes:
- AI writing assistants and grammar tools
- AI-powered search and summarization extensions
- Chatbot and conversational AI interfaces
- AI code assistants and developer tools
- AI image generation and editing tools
- AI translation extensions that use neural machine translation services
Delinea updates the curated list periodically as new AI extensions are published and existing ones are reviewed.
Suspected
A Suspected classification means the extension was not found on the curated list but triggered one or more heuristic signals that indicate AI involvement. Suspected extensions have not been individually verified by Delinea and may include false positives.
An extension classified as Suspected may turn out to be a standard extension that happens to share characteristics with AI tools. Administrators should review Suspected extensions and use enforcement policies to allow or block them based on organizational requirements.
How Detection Works
The AI detection system evaluates extensions in two stages. The curated list is checked first because it provides a definitive answer. Heuristic detection runs only when the extension is not found on the curated list.
Stage 1: Curated List Lookup
Delinea maintains a list of known AI extension identifiers (store IDs) across all supported browsers. When Browser Extension Manager discovers an extension during inventory collection, it checks the extension's store ID against this list. A match immediately classifies the extension as Confirmed.
The curated list is the most reliable detection method because each entry has been manually verified. It covers the most popular and widely deployed AI extensions but cannot cover every AI extension in existence, which is why heuristic detection exists as a fallback.
Stage 2: Heuristic Detection
When an extension is not on the curated list, Browser Extension Manager applies a set of heuristics to determine whether the extension is likely AI-related. The heuristics examine three categories of signals:
Host and API Permission Analysis
The extension's declared host permissions and API permissions are compared against known AI service endpoints and vendor backend domains. Examples include:
- API endpoints for major AI providers (for example, endpoints associated with OpenAI, Anthropic, Google, Cohere, Mistral, DeepSeek, Perplexity, Groq, and other large language model services)
- AI vendor-specific backend domains used by popular AI extensions for model inference, content generation, or data processing
- Writing and translation service domains commonly used by AI-powered extensions
An extension that requests access to one or more of these domains is likely communicating with an AI service.
Keyword Analysis
The extension's name and description are scanned for keywords and phrases commonly associated with AI functionality. Signal terms include:
- Direct AI references: AI, artificial intelligence, machine learning, neural network, deep learning, natural language, NLP
- Provider and model names: GPT, ChatGPT, Copilot, Gemini, Claude, LLM, OpenAI, Anthropic
- Capability indicators: generative AI, large language model, text generation, image generation, prompt engineering
- Feature descriptors: AI writing, AI assistant, AI copilot, AI agent, AI summarize, AI translate, AI chat, chatbot
Keyword matching uses the extension metadata as published in the browser store. A single keyword match in a relevant context is sufficient to trigger a Suspected classification.
Combined Signal Evaluation
The heuristic engine considers all signals together. A single strong signal (such as a host permission pointing to a well-known AI API endpoint) is enough to classify the extension as Suspected. Multiple weaker signals that individually might not be conclusive can also combine to produce a Suspected classification.
Viewing AI Classification Details
Administrators can see which signals triggered an AI classification in the Extension Resource Detail View. The detail view shows:
- Classification level – Confirmed or Suspected
- Detection method – Whether the classification came from the curated list or heuristic detection
- Triggering signals – For heuristic detections, the specific signals that contributed to the classification, such as matched host permissions or keywords found in the extension name or description
This transparency allows administrators to make informed decisions about whether a Suspected extension warrants further investigation or should be added to an enforcement policy.
Impact on Risk Scoring
AI classification directly affects an extension's Risk Scoring. Confirmed AI extensions receive a +10 modifier and Suspected AI extensions receive a +5 modifier. These modifiers are added on top of the permission-based score, reflecting the additional data handling considerations that AI extensions introduce.
The AI modifier alone does not push an extension into a higher risk level. It is one of several factors in the overall score calculation. An extension with minimal permissions and a Suspected AI classification may still score as Low risk.
Keeping the Curated List 13.0.x
The curated list is updated as part of the standard Browser Extension Manager update cycle. Delinea continuously monitors browser extension stores for new AI extensions and evaluates existing entries for accuracy. Administrators do not need to take any action to receive list updates.
If your organization discovers an AI extension that is not on the curated list and is not detected by heuristics, contact Delinea support. Reporting undetected AI extensions helps improve the curated list for all Browser Extension Manager customers.
Common Questions
Can I disable AI detection?
AI detection is part of the standard extension inventory process and cannot be disabled independently. If your organization does not need to track AI extensions, you can disregard the AI classification column in reports.
Does AI detection affect enforcement?
AI classification is informational. It feeds into the risk score and appears in reports, but enforcement policies are based on explicit Allow List and Deny List entries, not on AI classification alone. See "Building Enforcement Policies" on page 8 for details on creating policies that target specific extensions.
What happens when an extension is reclassified?
If an extension moves from Suspected to Confirmed (because it is added to the curated list), the classification and risk score update automatically on the next inventory collection cycle. The change is reflected in reports without administrator intervention.
Risk Scoring
Risk scoring assigns a numeric risk score to every discovered browser extension. The score gives administrators a quick way to prioritize review and helps auditors understand why a particular extension was flagged. This section describes how the score is calculated so that every number on a report can be traced back to specific extension characteristics.
How the Score Is Calculated
An extension's risk score is the sum of two components: Score = Permission Points + Modifiers
- Each permission declared in the extension's manifest is looked up in the permission point table and assigned a point value.
- All permission points are summed.
- Modifier adjustments are applied based on the extension's install source, AI classification, and manifest version.
The final number determines the extension's risk level.
Permission Classification
Before scoring, every permission declared in the extension manifest is classified into one of four types. The type determines how it is weighted and displayed in the extension detail view.
The four permission types are:
- RequiredApi: An API permission that the extension requires to function. The browser grants this permission automatically when the extension is installed. Examples include tabs, storage, cookies, webRequest, and activeTab.
- RequiredHost: A host permission that the extension requires to function. This grants the extension access to read and modify content on matching web pages. The URL pattern defines which sites are accessible. A pattern of <all_urls> grants access to all websites.
- OptionalApi: An API permission that the extension may request at run time. The browser prompts the user for approval before granting the permission. The extension can function without it.
- OptionalHost: A host permission that the extension may request at run time. Similar to OptionalApi, the user must approve the request before the extension gains access to matching sites.
Host permissions (RequiredHost and OptionalHost) carry higher risk weight than their API counterparts because they control which websites an extension can read and modify. An extension with <all_urls> host access can interact with every page the user visits, including banking sites, corporate portals, and email.
Permission Point Table
The following table lists every scored permission and the points it contributes to the total. Permissions not listed here contribute zero points.
When both webRequest and webRequestBlocking are declared together, they contribute 25 points total, not 25 each. If only webRequest is declared without webRequestBlocking, it is scored at 10 points because the extension can observe but not modify traffic.
| Permission | Points | Rationale |
|---|---|---|
| <all_urls> | 30 | Can read and modify content on every website the user visits |
| debugger | 30 | Grants full Chrome DevTools Protocol access, equivalent to browserlevel debugging |
| webRequest + webRequestBlocking | 25 | Can intercept, inspect, and modify all HTTP traffic before the browser processes it |
| nativeMessaging | 20 | Can communicate with native applications installed on the workstation |
| management | 20 | Can manage, enable, disable, and uninstall other browser extensions |
| proxy | 20 | Can redirect all browser traffic through an arbitrary proxy server |
| cookies | 15 | Can read and write cookies for any site, including session tokens |
| clipboardRead | 15 | Can read the contents of the system clipboard, which may contain passwords or sensitive data |
| tabs | 10 | Can see the URL, title, and favicon of every open tab |
| webNavigation | 10 | Can observe every navigation event across all tabs |
| history | 10 | Can read and modify the user's full browsing history |
| downloads | 10 | Can initiate and manage file downloads |
| contentSettings | 10 | Can modify per-site browser settings such as JavaScript, cookies, and plugin behavior |
| clipboardWrite | 5 | Can write to the system clipboard |
| activeTab | 5 | Can access the active tab when the user explicitly clicks the extension |
| bookmarks | 5 | Can read and modify all bookmarks |
| geolocation | 5 | Can access the user's physical location |
| storage | 0 | Extension-private storage only, no risk to user data |
| alarms | 0 | Scheduling mechanism internal to the extension |
| contextMenus | 0 | Adds items to the browser right-click menu |
| notifications | 0 | Can display desktop notifications |
Modifiers
After the permission points are totaled, the following modifiers are added or subtracted based on the extension's meta data.
Install Source Modifiers
| Condition | Modifier | Rationale |
|---|---|---|
| Sideloaded | +20 | Extension was installed from a local file, bypassing store review |
| Developer mode | +20 | Extension is running as an unpacked developer extension |
| Not from the official web store | +10 | Extension was installed from an alternative source without store vetting |
| Enterprise-deployed | -10 | Extension was pushed through enterprise policy, indicating organizational approval |
AI Classification Modifier
| Condition | Modifier |
|---|---|
| Confirmed AI extension | +10 |
| Suspected AI extension | +5 |
Manifest Version Modifier
| Condition | Modifier | Rationale |
|---|---|---|
| Manifest V2 | +5 | Manifest V2 extensions have broader access patterns and weaker permission boundaries than Manifest V3 |
Risk Levels
| Score Range | Risk Level | Color |
|---|---|---|
| 0-15 | Low | Green |
| 16-35 | Medium | Yellow |
| 36-60 | High | Orange |
| 61+ | Critical | Red |
Worked Examples
The following examples walk through the full calculation for three well-known extensions.
These examples were worked on April 30, 2026. The scores provided may not be up to date with any future changes in the example extensions.
Example 1: Microsoft Single Sign-On (SSO)
Microsoft SSO is a lightweight enterprise extension that facilitates Windows authentication in the browser. It ships as a Manifest V3 Chrome extension in the pre-staged set.
Microsoft SSO scores 20 and is classified as Medium risk. Although it declares a single permission, nativeMessaging is weighted heavily because it grants the extension a communication channel to a native Windows process. When deployed through enterprise policy, the -10 Enterprise-deployed modifier lowers the score to 10 (Low).
| Components | Value | Points |
|---|---|---|
| nativeMessaging (RequiredApi) | Communicates with the Windows SSO native host to exchange auth tokens | 20 |
| No install source modifiers | Installed from Chrome Web Store | 0 |
| No AI modifier | Not an AI extension | 0 |
| Manifest V3 | No MV2 modifier applies | 0 |
| Total | 20 |
Example 2: uBlock Origin
uBlock Origin is a popular open-source ad and content blocker. It ships as a Manifest V2 extension (the classic build).
uBlock Origin scores 80 and is classified as Critical risk. The score reflects the powerful permissions required for ad blocking, not any malicious intent.
uBlock Origin Lite (the Manifest V3 variant in the pre-staged set) scores materially lower because it uses declarativeNetRequest instead of webRequest/webRequestBlocking and does not request <all_urls> as a broad host permission.
| Components | Value | Points |
|---|---|---|
| <all_urls> (RequiredHost) | Must access all sites to block ads | 30 |
| webRequest + webRequestBlocking (RequiredApi) | Intercepts and blocks network requests | 25 |
| tabs (RequiredApi) | Observes tab URLs for per-site filtering | 10 |
| webNavigation (RequiredApi) | Hooks navigation events to apply filters early | 10 |
| No install source modifiers | Installed from web store | 0 |
| No AI Modifier | Not an AI extension | 0 |
| Manifest V2 | uBlock Origin classic uses MV2 | 5 |
| Total | 80 |
Example 3: Grammarly
Grammarly is a writing assistant that checks grammar and spelling on web pages. It ships as a Manifest V3 Chrome extension in the pre-staged set and appears on the curated AI list.
Grammarly (Chrome, MV3) scores 35 and is classified as Medium risk. Although it is a Confirmed AI extension, its declared permission set is narrower than extensions that request <all_urls> outright, so it does not reach the High or Critical band on Chrome. The Firefox build of Grammarly scores materially higher (60, High) because it declares additional permissions on that platform.
| Component | Value | Points |
|---|---|---|
| cookies (RequiredApi) | Maintains session state with the Grammarly service | 15 |
| tabs (RequiredApi) | Detects tab context for on-page suggestions | 10 |
| scripting, sidePanel, notifications, identify, storage (RequiredApi) | Standard MV3 APIs not weighted by the scorer | 0 |
| http:///, https:/// (RequiredHost) | Not matched by the scorer's wildcard / broad / specific patterns | 0 |
| Confirmed AI extension | Grammarly appears on the curated AI list | 10 |
| No install source modifiers | Installed from Chrome Web Store | 0 |
| Manifest V3 | No MV2 modifier applies | 0 |
| Total | 35 |
Using Risk Scores in Practice
Risk scores are most valuable when combined with enforcement policies.
- Triage new extensions: Sort the Browser Extension Inventory Report by risk score to focus review on the highest-scoring extensions first.
- Set policy thresholds: Use risk levels to guide Allow List and Deny List decisions. Many organizations start by explicitly allowing all Critical-scoring extensions they have vetted and blocking the rest.
- Audit trail – The Permissions breakdown is available in the Extension Resource Detail View for each extension. Auditors can inspect the exact permissions and modifiers that produced the score.
- Track changes over time: When an extension updates and adds new permissions, it risk score changes. The inventory report reflects the current score based on the latest discovered manifest.
Next steps
Once you understand how extension data is shown in Privilege Manager, you can start applying enforcement over browser extensions with policy.
For next steps, see the guides below:
