Somebody on your team wanted to grab a screenshot of a full web page. They found a free extension, clicked add, saw a gray box with some words in it, clicked the blue button, and got on with their day. Total elapsed time: nine seconds. Nobody read the gray box.
That gray box was a permission request, and depending on what it said, your company may have just handed a stranger a live feed of every website that employee visits, including your bank, your payroll portal, and your customer database. Browser extensions are the most powerful software most businesses install with the least thought. Here is what they can do, how a good one turns bad, and how to get a handle on what is running right now.
What That Permission Prompt Really Grants
The phrase people click past most often is some version of “read and change all your data on the websites you visit.” It sounds like boilerplate. It is not.
An extension with that permission is not standing outside your browser looking in. It is running inside the page with you, on every page. Whatever appears on your screen, it can read. Whatever you type, it can see. And “change” is the half nobody thinks about, because it means the extension can alter what a page shows you. On an ordinary workday, that covers:
- Everything inside your logged in accounts. Your email, your accounting system, your CRM. The extension is inside the session with you, so no password is needed. It sees what you see.
- What you type as you type it. Including into login forms and search boxes.
- The pages themselves. An extension that can change a page can alter a displayed account number, hide a warning, or add a form field that was never there.
- Related browser data. Chrome’s developer documentation lists permissions whose user facing warnings include reading your browsing history and reading data you copy and paste.
Google’s guidance to Chrome users is short and correct: make sure you only approve extensions that you trust. The trouble is that trust is asked for once, at nine seconds of consideration, and never expires on its own.
How a Good Extension Goes Bad
Here is the part that makes this different from most software risk. The extension you installed is often not the extension you are running today.
Extensions update themselves silently in the background. That is a feature, and mostly a good one. But it means the code changes without anyone approving the change, and the permissions you granted carry forward to whatever the new code does. Two things happen in the real world. First, a developer with a modestly popular free extension gets an unsolicited offer to buy it, often for a surprising amount of money, and takes it. The new owner ships an update. Second, a developer’s own account gets compromised and someone else ships the update for them.
Either way, users notice nothing. The icon is the same, the feature still works, the reviews still say it is great, because the reviews are years old. This is also why the “it has four stars and two million users” reasoning is weaker than it feels. Popularity is exactly what makes an extension worth buying.
The Categories Worth a Second Look
We are not saying every extension is a threat. We are saying certain categories combine broad permissions with a business model that is not obvious, and that combination deserves scrutiny.
- Coupon and shopping helpers. To find you a discount on any site, they watch you on every site. That is the deal, rarely stated that plainly.
- Screenshot and screen recording tools. A tool whose entire job is capturing what is on your screen is, by design, a tool that can capture what is on your screen.
- PDF converters and document tools. Many of these upload your document to somebody’s server to do the work. That is the actual product. Ask where your signed contract went.
- Grammar and writing assistants. To check your writing everywhere, they read your writing everywhere, including in your email and your client portal.
- Free VPN and proxy add-ons. These sit between you and everything you visit. Google notes that extensions changing lower level network access through VPNs or proxy settings are not governed by the ordinary site permission controls.
- Anything installed to solve a one time problem. The converter someone needed once in March is still running in August with full access. Nobody ever goes back and removes these.
Worth noting: in a joint advisory published in 2025, the FBI and CISA listed browser extension data among the categories that information stealing malware pulls off an infected machine. Extensions are not just a possible risk in themselves. They are also a target.
How to Audit and Control This
You cannot fix what you cannot see, and almost no small business has ever looked. Start here.
- Inventory what is installed. Every major browser has an extensions management page listing what is running and what each one was granted. Walk one machine to see how bad it is, then get a list from every machine. A device management platform can usually pull this for you in minutes.
- Ask one question per extension. Does someone here still use this for work? If the answer is no, or nobody knows, remove it. The average business can safely delete more than half of what it finds on the first pass.
- Tighten site access on what survives. Chrome lets you set an extension’s site access to run only when you click it, or only on specific sites, instead of on all sites. That setting lives on each extension’s details page in the browser’s extension manager. A screenshot tool does not need standing access to your bank.
- Build a short approval list. Decide which extensions are allowed for work, write them down, and tell people how to request an addition. Keep the list genuinely short. A list of thirty is not a policy, it is a shrug.
- Enforce it centrally. Business editions of the major browsers support managed policies that let you allow only approved extensions and block everything else. This is the step that turns a good intention into an actual control, and it is usually included in software you already pay for.
- Re-audit twice a year. Put it on the calendar next to something else you already do. Extensions accumulate the way cables accumulate in a drawer.
If this feels familiar, it should. Unapproved extensions are a textbook example of the pattern we described in our article on shadow IT and the hidden security, legal, and financial risk inside your own organization: useful tools, adopted with good intentions, that nobody approved and nobody is tracking.
The Bottom Line
Fewer is better. That is the whole policy. Every extension on a work computer is a piece of software with deep access to your business that updates itself without asking, from a developer you have never met, who might not even be the same developer next month.
None of this means banning extensions. Some are genuinely worth their access. It means treating an extension like any other vendor that wants a key to your filing cabinet: know who they are, know what they get, limit it to the job, and check occasionally that the arrangement still makes sense. That is not paranoia. That is being a landlord about your own systems. For the wider view, see our piece on why cybersecurity is no longer optional for mid-sized businesses.
If you would like help running an extension audit or setting up managed browser policies so this stops being a recurring problem, that is a quick engagement and a genuinely useful one. We work with small and mid sized businesses across Denton County. Contact us today.
Sources:
Comments are closed