In this guide · 7 sections
Short answer
Bad extensions read pages and steal session cookies, which skip passwords and MFA. Trusted extensions can turn malicious after a hijacked or sold developer account pushes an update. Fix it by blocking all extensions except an approved list in Chrome or Edge management, and reviewing the list every quarter.
How malicious browser extensions steal data
An extension is a small program that runs inside the browser with the permissions it asked for at install. Microsoft's Edge extension management guide splits them into host permissions (which websites the extension can view or modify) and device permissions (such as USB, storage or screen access). The dangerous ones are broad host permissions.
| Permission (as Chrome shows it) | What it allows | Risk at work |
|---|---|---|
| Read and change all your data on all websites | See and edit every page, including webmail and banking | High: can copy emails, invoices, form data |
| Read your browsing history | List of every site visited | Medium: reveals clients, suppliers, banks |
| Access cookies (via host access) | Read login session tokens | High: account takeover without MFA |
| Manage your downloads | Change or open downloaded files | Medium: can swap files |
| Communicate with native applications | Talk to programs on the computer | High: reaches beyond the browser |
Session cookies are the main prize. After you sign in, the browser keeps a cookie that proves the session is already authenticated. A copy of it lets someone else use the session from their own machine, which is why MFA does not help once the cookie is stolen. Phishing-resistant sign-in and short session lifetimes reduce the damage, but keeping bad code out of the browser is the first line.
How trusted extensions turn bad
Extensions update themselves silently. That is good for security fixes, and bad when the new version is not from the people you trusted.
- Hijacked developer accounts. On 25 December 2024 attackers published a malicious version of the Cyberhaven extension after phishing an employee into authorising a fake app on the company's Chrome Web Store account. TechCrunch reported that customers were told sessions and cookies could have been sent to the attacker's domain; other extensions were hit in the same campaign.
- Sold extensions. Popular free extensions are bought by new owners, who can add tracking or data collection in an update. Users see no warning unless the update asks for new permissions.
- Look-alikes. Fake versions of popular tools (PDF converters, AI assistants, ad blockers) copy the name and logo of the real one.
- Free AI and productivity helpers. Tools that summarise or rewrite pages need to read those pages. Our AI email assistant guide explains what they can see.
Allow-list extensions in Chrome (Google Admin console)
If your team uses Google Workspace or Chrome Enterprise Core, you can manage extensions from the Google Admin console. Google's allow or block apps and extensions page describes three modes: allow all and block some, block all and allow some, or block all and let users request extensions.
Turn on Chrome browser management
Settings apply to users signed in to Chrome with their work account, or to enrolled browsers on Windows, Mac and Linux.
Review what's already installed
Use the apps and extensions usage report to see every extension across your browsers before blocking anything.
Set Allow/block mode
Go to Devices > Chrome > Apps & extensions > User app settings (or Chrome browser > Apps & extensions > Settings on Chrome Enterprise Core) and choose 'Block all apps, admin manages allowlist, users may request extensions'.
Approve the extensions you need
Add the password manager, meeting and signing tools staff actually use under Users & browsers. Force-install the password manager so it can't be removed.
Handle requests
Staff request new extensions from the Chrome Web Store; you approve or block them under Requests. Test on a small organisational unit first, as Google recommends.
Chrome also supports blocking by permission and stopping extensions from running on chosen sites with the ExtensionSettings policy (runtime_blocked_hosts), set through Group Policy on Windows per Google's Windows policy guide. That's useful to keep all extensions off your banking and payroll sites.
Control extensions in Microsoft Edge with Intune
For Microsoft 365 businesses using Edge, the same controls come through Intune or Group Policy. Microsoft recommends managing extensions mainly by permissions and site access, with allow and block lists where needed.
- ExtensionInstallBlocklist set to * blocks every extension not explicitly allowed.
- ExtensionInstallAllowlist lists the IDs of approved extensions.
- ExtensionInstallForcelist installs required extensions (such as your password manager) without user action.
- ExtensionSettings blocks permissions and keeps extensions off sensitive sites.
Remember other browsers. If staff can install Chrome, Firefox or Brave on a managed laptop and use them unmanaged, the policy has a hole. Either manage each browser in use or block unmanaged browsers through your device management and endpoint protection.
Review extensions every quarter
An allow-list drifts: approved extensions get sold, change permissions or stop being needed. A short quarterly review keeps it honest.
Quarterly extension review
Fold this into your wider tenant review; our Google Workspace security checklist lists the other settings worth checking at the same time.
Do it yourself or get help?
If your team is under ten people on Google Workspace, you can set the allow-list yourself in an afternoon using the steps above. Plan a week of handling requests while staff discover what they relied on. It is harder on unmanaged laptops, mixed browsers or when staff use personal Chrome profiles for work.
Our Antivirus & Endpoint Protection Rollout (S$390) adds web filtering and protection on up to 10 devices, and our Microsoft 365 / Google Security Lockdown (S$590) covers browser and extension policies, session controls and admin settings in your tenant.
Frequently asked questions
Yes, if it has permission to read the pages you visit. It can capture what you type into login forms and copy session cookies, which let an attacker use your signed-in session without the password or an MFA prompt. Only install extensions you need, from publishers you trust, and remove ones you no longer use.
With Google Workspace or Chrome Enterprise Core, go to the Google Admin console, open the Chrome apps and extensions settings, and choose to block all apps with an admin-managed allowlist, optionally letting users request extensions. Then add the extensions you approve. On Windows without Google management, use the ExtensionSettings Group Policy instead.
Yes. Extensions update automatically, so if the developer's account is hijacked or the extension is sold, a malicious update reaches every user. In December 2024 attackers published a bad version of Cyberhaven's Chrome extension after phishing a developer account. Allow-lists, permission limits and regular reviews reduce the exposure.
Not fully. MFA protects the sign-in step, but an extension that copies the session cookie after you sign in lets an attacker use that session directly. Combine MFA with an extension allow-list, phishing-resistant sign-in such as passkeys, shorter session lifetimes, and revoking sessions if you suspect a bad extension.
Remove it from every browser, revoke all sign-in sessions for affected users in Microsoft 365 or Google Workspace, change passwords used in that browser and rotate API tokens. Check mailbox rules, forwarding and recent sign-ins for signs of misuse. Then set an allow-list so it can't be reinstalled.