The Least-Audited Software on the Endpoint Lives in the Browser Toolbar

A browser extension is a small program that runs inside the one application almost every employee uses all day, with permission — usually granted at install and never revisited — to read and modify the content of every page visited. That description would set off alarms if it were applied to any other category of software. Applied to extensions, it is met with a shrug, because they arrive from official stores, look like conveniences, and are installed by users rather than by IT. The risk is not primarily malicious extensions at the point of publication, though those exist. It is what happens to a benign extension over its life. Popular ones are bought, sometimes by parties whose business is data, and the new owner pushes an update that the store delivers silently to everyone who ever installed it. Abandoned ones have their developer accounts taken over. Legitimate ones add a monetisation module from a third party that turns out to exfiltrate browsing history. In each case the user consented to something quite different, years earlier, and nothing in the browser signals that the deal changed. Enterprises are catching up in the plain way: managed browser policies that whitelist extensions by identifier, block the rest, and pin versions or at least review updates for the ones that matter. That is straightforward on managed devices and nearly impossible on the personal laptops that a share of every workforce still uses for work, which is why the more durable control is on the other side — treating the browser session as an untrusted client and not letting a page hold anything an extension could usefully steal. For a smaller company without an endpoint team, the achievable version is an inventory and a habit. Know which extensions the people who handle money and customer data actually run, remove the ones nobody can justify, and treat a request for broad new permissions on update the way you would treat an unexpected request for admin rights. It is not sophisticated. It is simply a category of software that has been exempt from the ordinary rules for no better reason than where it sits.