Browser extensions are small pieces of software, but from a security perspective, they can have a surprisingly large impact. From data theft to session-token leakage, a compromised or malicious browser extension can introduce risks that are easy to overlook.
Extensions live very close to the user’s browsing activity. Depending on the permissions granted, an extension may be able to read web pages, modify browser content, access browsing data, monitor open tabs, or communicate with external services.
In an enterprise environment, an unexpected browser extension can therefore become an important signal for investigation. Examples include unknown AI tools, free VPN extensions, browser-based proxy services, password managers that are not approved by the organization, or remote-access tooling.
The presence of such an extension does not automatically mean that a system is compromised. However, it can indicate shadow IT, policy violations, unwanted software, or potentially malicious activity.
Security risk?
Broader permissions
Browser extensions can request permissions that provide significant access to the browser and the websites a user visits. Depending on the extension and browser, these permissions may allow an extension to inspect tabs, interact with websites, access locally stored extension data, or modify content displayed to the user.
The important question from a security perspective is whether those permissions are actually required for the extension’s intended functionality. For example, consider an extension requesting broad access:
{
"manifest_version": 3,
"name": "My Extension",
"permissions": [
"tabs",
"http://*/*",
"https://*/*",
"storage"
]
}This is why extension permissions should be treated similarly to application permissions: access should be limited to what is actually necessary.
Data sharing and privacy
Some extensions collect information about how users browse the web. Depending on their functionality, this could include URLs, search queries, website content, telemetry, or other information.
The security concern becomes greater when this information is transmitted to external infrastructure.
This is especially relevant for extensions providing services such as free VPNs, AI assistants, translation tools, browser automation, shopping assistants, or productivity tools. These extensions may legitimately need to process browser data to provide their functionality, but organizations should understand what information is collected, where it is sent, and how it is protected. Free services deserve additional scrutiny because their business models can vary considerably. Organizations should review the extension’s permissions, privacy policy, publisher, and data-handling practices.
Session and token exposure
Here is where the actual identity risk comes in. Modern applications rely heavily on browser sessions, cookies, and authentication tokens.
If a malicious extension has sufficient permissions to access sensitive page content or interact with authenticated applications, it may be able to obtain sensitive information associated with an active session. Depending on the application and the authentication artifact obtained, this could potentially allow an attacker to abuse an existing authenticated session.
A stolen session or authentication artifact can sometimes be more useful because the user has already completed the authentication process, potentially including multi-factor authentication. This is similar to the well-known AITM attack.
Content manipulation
Extensions are not limited to reading information. Some extensions can also modify what users see inside the browser.
For legitimate extensions, this capability is useful. Password managers can insert credentials, accessibility extensions can modify page layouts, and productivity extensions can add functionality to existing websites.
A malicious extension could abuse similar capabilities.
For example, it could potentially:
- Inject additional JavaScript into websites.
- Modify links displayed to the user.
- Insert advertisements or tracking mechanisms.
- Redirect users to another website.
- Alter forms before information is submitted.
- Display fake authentication prompts.
This creates an interesting security problem because the website itself may not actually be compromised. The manipulation can happen locally inside the user’s browser via the manipulation process of the extension.
Some interesting reads:
2024: “Arcanum: Detecting and Evaluating the Privacy Risks of Browser Extensions” Tested Chrome Web Store extensions against sensitive sites including Gmail, Outlook, PayPal, and LinkedIn, finding hundreds automatically extracting webpage content and privacy risks across thousands of extensions. USENIX paper
2025: “Malicious GenAI Chrome Extensions.” Researchers analyzed 5,551 AI-themed extensions and ultimately studied a set containing 341 malicious extensions, including extensions impersonating GenAI tools and performing data exfiltration or redirects. Research paper
Known malicious extensions
Only at the beginning of 2026 have there already been plenty of reported malicious browser extensions:
| Extension / Campaign | Attack Type |
|---|---|
| AiFrame | Credential Theft / Data Exfiltration |
| Malicious ChatGPT Extensions | Session Hijacking / Token Theft |
| AI Assistant Extension Campaign | AI Data Theft / Surveillance |
| Socket 108-Extension Cluster | OAuth Theft / Backdoor / Ad Fraud |
| Live Wallpaper Cluster | Tracking / Search Manipulation |
| StegoAd | Malware Delivery / Credential Theft |
| QuickLens Supply-Chain Compromise | Supply Chain / Crypto Theft |
| Socket 19-Extension Crypto Campaign | Wallet Draining / Credential Theft |
| Video Effects for YouTube | Data Exfiltration / Ad Fraud |
| WAToolkit | Session Hijacking |
| Cyberhaven Extension | Supply Chain / OAuth Abuse |
With local admin rights?
No local administrator required
Another important consideration is that installing a browser extension often does not require local administrator privileges.
Browsers such as Chrome, Edge, and Firefox can generally install extensions within the user’s browser profile. This means that an organization may have removed local administrator privileges from its users while those users are still able to introduce additional software-like functionality into their browsers.
From a security perspective, this creates an interesting gap. Traditional application-control measures may prevent a user from installing an executable or MSI package, while the same user may still be able to install a browser extension capable of interacting with websites and potentially accessing sensitive browser data.
For that reason, browser extensions should be managed similarly to other software. Many organizations heavily restrict traditional software installation while leaving browser-extension installation relatively open.
A good example is VPN software. An organization might prevent users from installing traditional VPN applications while still allowing unrestricted access to browser extension stores, where numerous VPN and proxy extensions are available.
And what do you think about all the AI extensions to leverage AI tools, chat with AI, share files, or share website data?. When checking the Chrome Web Store, there are many extensions related to AI or prompts. Using extensions without any installation permission is dangerous; yup.
Manifest file
The manifest file can be found in the user data of the browser in the extension folder:
The manifest.json file contains metadata about the extension and defines capabilities such as the permissions requested by the extension. Reviewing the manifest can therefore provide useful information during an investigation, especially when you want to understand what an unknown extension is capable of doing.
Real-world examples
The risks associated with browser extensions are not only theoretical. There have been multiple real-world examples: 2024 – Cyberhaven: A supply-chain compromise in which a legitimate browser extension was compromised and a malicious version was distributed to users. The malicious update was designed to steal sensitive browser data, including cookies and authentication-related information.
2023: PDF Toolbox: A malicious Chrome extension with millions of installations was reported to contain code that could inject arbitrary JavaScript into websites. This demonstrated how an extension that appears to provide a simple utility can potentially introduce much broader functionality.
2022: Dormant Colors: A campaign involving dozens of malicious Chrome and Edge extensions with more than one million installations. The extensions appeared to provide browser customization functionality but could redirect browsing and search activity and load additional code.
2020: Chrome Web Store spyware campaign: Researchers identified more than 70 malicious Chrome extensions that had reportedly accumulated around 32 million downloads. The extensions collected browsing history and other data and sent it to attacker-controlled infrastructure.
2019: DataSpii: Multiple browser extensions collected browsing data from millions of users. The exposed information included URLs associated with sensitive corporate and personal resources, demonstrating that even browsing-history collection can result in significant data leakage.
2018: MEGA Chrome extension compromise: The official MEGA Chrome extension was compromised, and a malicious version was distributed through the Chrome Web Store. The modified extension was designed to steal credentials and other sensitive information from selected websites.
2017: Web Developer extension compromise: The popular Web Developer Chrome extension was compromised after its developer was reportedly targeted through phishing. A malicious version was subsequently published to users, demonstrating that even established and widely trusted extensions can become a supply-chain attack vector.
And to be honest, with the rapid development of extensions in browsers related to AI and development AI, we should be more careful about what is installed.
Identifying installed browser extensions
Threat & Vulnerability Management (TVM)
If you’re using Microsoft Defender for Endpoint together with Microsoft Defender Vulnerability Management, Defender provides useful capabilities for browser-extension visibility, although there are licensing and platform requirements.
Microsoft Defender Vulnerability Management provides visibility into browser extensions installed across the environment. This can be useful both for maintaining an inventory and for hunting for potentially unwanted or risky extensions. One important consideration is licensing. Depending on your Microsoft licensing, the browser-extension assessment capabilities may require Defender Vulnerability Management.
The following licenses are needed:
- Microsoft Defender Vulnerability Management Standalone
- Microsoft Defender for Endpoint Plan 2 + the Defender Vulnerability Management add-on
- For servers; Defender for Server Plan 2 (add-on is included)
It is great for visibility into permissions, vulnerabilities, and specific versions; all only available via the add-on and for Windows using Microsoft Edge, Chrome, and Firefox.
More information: Browser extensions assessment in Microsoft Defender Vulnerability Management
Blog: How to check and block “malicious” browser extensions with Microsoft Defender and Intune?
Defender native
We can use native Defender features to identify and block malicious browser extensions. For Microsoft Edge and Chrome, the extension is a CRX extension file. CRX is the package for all Chromium-based browsers. The CRX file is essentially a ZIP archive including a manifest JSON, content script, background scripts, and additional data. The result can be used in a custom detection.
CRX layout:
Because Chromium-based browsers download CRX packages during the extension installation process, we can use Microsoft Defender XDR Advanced Hunting to look for this activity. This approach is useful for detecting installation attempts or download activity, but it should not be considered a complete inventory of extensions that are currently installed on a device.
Because historical telemetry is retained for a limited period, this should not be used as a long-term extension inventory. However, the query can be used in a custom detection to identify new extension installation activity or to hunt for specific extension IDs.
More information in one of my earlier blogs: How to check and block “malicious” browser extensions with Microsoft Defender and Intune?
DeviceFileEvents
| where ActionType == "FileCreated"
| where FolderPath contains "Webstore Downloads"
| where FileName endswith ".crx"
| extend ExtensionId = extract(@"(?i)Webstore Downloads[\\/]([^\\/]+?)_\d+\.crx$", 1, FolderPath)
| where isnotempty(ExtensionId)How to block extensions and allow trusted ones?
It is possible to block extensions for the browser. Via GPO or Intune, the settings can be pushed where the extension list is controlled. In this specific example, I will explain Microsoft Edge and Google Chrome (Firefox is similar). Via Intune, it is possible to use the settings catalog to block all extensions or allow specific extensions/ block specific extensions.
Block Google Chrome extensions with Intune
To block Google Chrome extensions, a new profile in Intune is needed. Use the following information:
- Platform: Windows 10 and later
- Profile type: Settings catalog
Give the policy a good name and optional description.
Click on Add settings and search for the following setting in the setting picker of the cloud catalog store:
- Configure extension installation blocklist
Click on Google Chrome Extensions, and toggle Configure extension installation blocklist
In the settings, enable Configure extension installation blocklist to Enabled and add a wildcard for the ID *
Using * creates a default block for extensions unless they are explicitly exempted by another applicable extension policy.
Block all and add exceptions
When extensions are used, it is recommended to block all extensions and add some exceptions. This will allow us to define extensions that can be installed by the user. The exception is based on the extension ID, which can be found at the Chrome Web Store.
For the exception list, we can use the same policy as above; only we need to exclude the extension. Search in the settings picker for; Configure extension installation blocklist and add the following setting:
Extension IDs to exempt from the blocklist (device)
Toggle Configure extension installation allow list to Enabled
In the settings, enable Configure extension installation allow list to Enabled and add the extension IDs; each ID can be added on a single rule.
To find the extension ID, go to the Google Chrome Web Store https://chromewebstore.google.com/ and search for the extension. In the URL of the extension page, copy the ID; an example of the ID format is: nngceckbapebfimnlniiiahkandclblb
Block Microsoft Edge extensions with Intune
Microsoft Edge is similar; for Microsoft Edge, use the following settings in the catalog. For the settings catalog of Microsoft Edge extensions, search for Microsoft Edge in the settings picker and select the Microsoft Edge\Extensions category.
Microsoft Edge provides policies that can be used to block extension installation while allowing specific approved extension IDs.
With the wildcard *, it is possible to block all extensions from being installed, and with Allow specific extensions, you can whitelist specific extensions to be installed:
There are several ways to block or allow specific extensions from being installed in Microsoft Edge profiles. Numerous online resources explain how to configure extension allowlists and blocklists across different browsers. Once you understand the required configuration, these restrictions can be implemented using the Settings Catalog, Group Policy (GPO), or even PowerShell.
Conclusion
Browser extensions should not be ignored simply because they do not require a traditional software installation. They can interact directly with websites, browser sessions, and user data, while users can often install them without local administrator privileges.
Microsoft Defender provides multiple ways to improve visibility. Defender Vulnerability Management can provide an inventory of installed browser extensions in supported environments, while Microsoft Defender XDR Advanced Hunting can help identify CRX download and installation activity.
The most important takeaway from this blog is simple: track browser extensions and maintain control over what users can install. Extensions can introduce significant security risks even when users do not have local administrator rights.
