The dangers of browser extensions and how to manage them

On Christmas Eve 2024, a data security company’s own Chrome extension was replaced with a malicious version. An attacker had phished one of its developers with a fake “Chrome Web Store” policy warning, gained publishing access and pushed an update straight to users’ browsers. Researchers later linked the campaign to at least 35 compromised extensions with more than 2.6 million users, which is why browser extension security belongs in your security plan.

Nobody in those offices clicked anything new. An extension they already trusted updated itself. We have found bad extensions on client computers too, and they are easy to miss: they sit inside the browser where staff check email, open client files and sign in to everything.

Why extensions are a business risk

An extension is a small program that runs inside Chrome, Edge or Firefox: ad blockers, PDF tools, grammar checkers, coupon finders, screenshot tools. To do their job, many ask for permission to “read and change all your data on all websites.” That covers your webmail, your bank, your practice management system and every cloud app you use.

• Updates install automatically, so an extension that was safe at install can change later through a sale to a new owner or a hijacked developer account.
• Store badges and good reviews have appeared on extensions that later turned malicious.
• Staff install extensions on their own, and most security tools aren’t set up to report which ones are running.

What recent extension attacks did

These cases were reported by security researchers over the last two years.

• In the December 2024 campaign above, the malicious version targeted Facebook account data and access tokens, which matters to any business that runs ads or pages through Facebook.
• In July 2025, researchers found 18 extensions in the Chrome and Edge stores, including emoji keyboards, weather apps, volume boosters and a color picker, affecting about 2.3 million users. They started out legitimate and were later updated to capture every page users visited.
• A free VPN extension with about 6 million Chrome users and a Featured badge pushed an update in July 2025 that captured prompts and responses from ChatGPT, Claude, Microsoft Copilot, Gemini and other AI tools.
• In January 2026, a campaign researchers called the “Zoom Stealer” used 18 extensions posing as meeting helpers across Chrome, Edge and Firefox to collect meeting links with embedded passwords, topics and attendee details from about 2.2 million users.

That AI example connects to a bigger issue. If staff paste client details into AI tools, an extension can capture them too. Our post on shadow AI covers that side.

What a browser extension security policy should cover

We write acceptable use policies for clients, and extensions fit naturally inside one. Whatever document it lives in, it should answer these questions:

• Which browsers are approved for work, and whether work happens in a separate work profile.
• Whether extensions are blocked by default, with a short approved list.
• Who owns the approved list and who can say yes to a new request.
• How staff request an extension and how long a decision takes.
• What happens to extensions already installed when the policy starts.
• How often the list and installed extensions are reviewed.

A simple outline you can adapt

1. Purpose and scope: every company device and every work browser profile.
2. Default rule: all extensions blocked except those on the approved list. Required tools, such as your password manager, are installed automatically and can’t be removed.
3. Approved list: name, publisher, business reason and owner for each extension.
4. Review questions for new requests: do the permissions match the job, who publishes it, is it maintained, and how does a free extension make money?
5. Personal use: personal extensions stay in a personal browser profile, away from work accounts.
6. Reporting: staff report new toolbars, changed search engines, sudden permission requests, pop-ups or redirects.
7. Review schedule: audit installed extensions at least once a year and whenever a new extension attack makes the news.

Rolling it out without a revolt

Start with an audit. Some of what people use will be legitimate and belongs on the list. Some will be abandoned tools nobody remembers adding. Then turn on the policy. Both Chrome and Microsoft Edge support block-by-default rules, forced installs and blocks on extensions that request certain permissions, and these can be pushed through Group Policy or Microsoft Intune. A short note to staff explaining why their coupon tool is gone saves a lot of tickets.

For offices that keep patient, client or financial records, an unknown extension that can read every page can also read the patient portal, the tax software or privileged email. That is hard to explain in a risk assessment, which is why extension control belongs on the list for healthcare practices, accounting firms and law offices alike. It sits alongside the other parts of our layered security, and pairs well with avoiding fake software ads.

Start with the audit: find out what is running in your browsers today. Book a 15-minute call and we’ll help you set a sensible approved list.

Related reading: QR code phishing: How quishing works and how to avoid it, Dark web monitoring: What you need to know and Cost of a data breach: How it can hit your business for years.

Frequently asked questions

What is a browser extension?

A browser extension is a small program that runs inside Chrome, Edge or Firefox, such as an ad blocker, PDF tool, grammar checker or coupon finder. Many ask for permission to read and change all your data on all websites, which covers webmail, banking and every cloud app you sign in to. Extensions update themselves, so one that was safe at install can turn malicious later.

How do I remove or disable a browser extension?

In Chrome, go to chrome://extensions, and in Edge, go to edge://extensions. Turn off an extension’s switch to disable it, or select Remove to delete it. For a whole company, block extensions by default and allow an approved list through Group Policy or Microsoft Intune, which is far easier than checking each computer.