What to take away
Browser extensions run inside authenticated SaaS tabs where SSO, MFA, and network firewalls already trust the session. Auditing them requires collecting a live inventory across Chrome, Edge, and Firefox, ranking extensions by host and API permission exposure rather than store ratings, and moving managed browsers from open installation to a permission-based blocklist or allowlist.
1. Why browser extensions sit outside your SSO and OAuth inventories
When an employee signs into Salesforce, Google Workspace, Microsoft 365, GitHub, or your internal admin panel, a browser extension granted broad host permissions across all URLs can read page DOM contents, capture pasted text, inspect cookies or web requests, and exfiltrate data without ever appearing in Microsoft Entra ID or Google Workspace OAuth consent logs.
Legitimate extensions also change ownership or update manifests silently in the background. Treating store star ratings or install counts as safety proof misses abandoned extensions, free VPN proxies, PDF converters, and unapproved AI sidebar assistants that scrape every open tab.
References: Google Chrome Enterprise Help - Manage extensions in your enterprise · Microsoft Learn - Manage Microsoft Edge extensions in the enterprise
2. Collect an inventory across Chrome, Edge, and Firefox
A Chrome-only audit leaves an easy blind spot if developers use Firefox or finance teams use Microsoft Edge. Pull installed extensions from every managed browser in use, recording the browser, extension name, version, install type (force-installed, user-installed, sideloaded/unpacked), and number of affected employees.
Document browser-specific visibility limits clearly. Native Chrome Browser Cloud Management and Edge management policies report Chromium add-ons, Mozilla enterprise policies govern Firefox add-ons, and Apple Safari manages web extensions separately through macOS app packaging and MDM restrictions.
References: Google Chrome Enterprise Help - Manage extensions in your enterprise · Microsoft Learn - Manage Microsoft Edge extensions in the enterprise · Mozilla Support - Manage add-ons using Firefox enterprise policies
3. Rank extensions by permission exposure, not brand familiarity
Triage the highest-reach permissions first so a lean security team can review 10 high-exposure add-ons this week rather than stalling on 200 harmless theme or calculator extensions.
| Permission signal | What the extension can do | Default review action |
|---|---|---|
| Broad host access across all websites plus cookies or webRequest APIs | Read or modify content and session data across every authenticated SaaS tab | High exposure: restrict immediately unless owned, contracted, and allowlisted |
| Clipboard read, tabs, scripting, or debugger APIs on work domains | Capture copied secrets, URLs, or inject scripts into active web apps | High or Medium exposure: verify business owner, publisher, and least-privilege alternative |
| AI sidebar, screen-recorder, or free VPN / proxy add-ons | Send page summaries, transcripts, or traffic to external infrastructure | Block unapproved consumer add-ons; steer staff to approved corporate AI tools |
| Active-tab only or narrow single-site scope with minimal APIs | Interact with the current tab only when explicitly invoked by the user | Low exposure: permit under standard publisher review and monitor version changes |
| Unpacked / developer-mode or off-store installations | Run unreviewed local code outside store malware checks | Disable developer-mode unpacked extensions on non-engineering profiles via policy |
References: Google Chrome Enterprise Help - Manage extensions in your enterprise · Elba Documentation - Browser extension security capabilities and permission exposure
4. Move from open installs to ExtensionSettings and permission blocks
Once you know what employees rely on, tighten native browser policies in stages so you do not break password managers or accessibility tools overnight. Start by blocking high-risk runtime permissions (such as wildcard host access or cookie access for unapproved extensions) using Chrome and Edge ExtensionSettings blocked-permission and runtime-blocked-host rules, while disabling off-store or unpacked installs.
Next, publish a curated self-service allowlist in Google Admin Chrome App Management, Microsoft Intune, and Firefox enterprise policies (policies.json), paired with a fast request workflow so employees can ask for a vetted tool without shadowing IT.
- Protect sensitive internal hosts (SSO domains, cloud consoles, banking, payroll, and admin portals) with runtime host-blocking policies even for otherwise allowed extensions.
- Pin force-installed security and password-manager extensions so users cannot remove them.
- Re-check extensions whenever a major update requests newly elevated permissions.
References: Google Chrome Enterprise Help - Manage extensions in your enterprise · Microsoft Learn - Manage Microsoft Edge extensions in the enterprise · Mozilla Support - Manage add-ons using Firefox enterprise policies
How Elba inventories and scores browser extension risk
Elba’s browser security extension inventories installed extensions across managed Chrome, Edge, and Firefox browsers (Safari does not expose installed extension inventory). On Chrome and Edge, Elba evaluates requested capabilities and assigns a Permission Exposure level (Low, Medium, High, or Not assessed) so teams can focus immediately on high-exposure add-ons.
To protect employee privacy while surfacing workspace risk, Elba hashes raw extension identifiers and does not expose raw host patterns in stored telemetry. Browser Extension Playbooks summarize extensions needing review so administrators can investigate risky add-ons alongside OAuth grants and Shadow AI usage, then enforce removal or blocklists through Chrome Enterprise, Intune, or MDM.
References: Elba Documentation - Browser extension security capabilities and permission exposure · Elba Documentation - Security Playbooks
Enterprise browser extension audit checklist
Your checks stay on this page and reset when you reload it.
Common questions
Does revoking OAuth apps in Google Workspace or Entra ID remove browser extensions?
No. Browser extensions execute locally inside the browser profile using manifest permissions rather than directory OAuth tokens, unless the extension also requested an OAuth grant. You must audit and govern browser extensions separately through browser telemetry and MDM policies.
Which browsers support extension inventory and permission scoring in Elba?
Elba inventories installed extensions on Chrome, Edge, and Firefox, and calculates Permission Exposure (Low, Medium, High, or Not assessed) on Chrome and Edge. Safari 26+ supports Elba’s AI prompt/upload controls and domain rules, while installed extension inventory is not available on Safari.
Should an SMB switch straight to a strict extension allowlist?
Moving directly to a default-deny block rule without an initial inventory often breaks password managers, translation tools, or developer extensions. Run a two-week discovery pass first, pre-approve essential extensions, block dangerous permissions and sensitive hosts via ExtensionSettings policies, and then enable default-deny allowlisting.
Can an approved extension still read our identity provider or banking tab?
Yes, if it holds broad host permissions and you have not restricted sensitive domains. Use runtime host-blocking rules in Chrome and Edge ExtensionSettings policies to prevent even approved productivity extensions from running on SSO login pages, cloud infrastructure consoles, and payroll portals.
Sources & further reading
Primary documentation used to review this guide. Product settings and edition requirements can change; check the linked documentation before making changes.
- Google Chrome Enterprise Help - Manage extensions in your enterprise
- Microsoft Learn - Manage Microsoft Edge extensions in the enterprise
- Mozilla Support - Manage add-ons using Firefox enterprise policies
- Elba Documentation - Browser extension security capabilities and permission exposure
- Elba Documentation - Security Playbooks