Every office browser is carrying passengers. Extensions were installed in ten seconds, given permission to read every website, and then forgotten — by the user, and by IT. This is the audit almost nobody does, and it closes one of the quietest data leaks in a small office.
Open the extensions page of any office browser — chrome://extensions in Chrome, edge://extensions in Edge — and read the permission line under a typical free add-on: "Read and change all your data on all websites." That coupon finder, PDF converter or video downloader can see the banking page, the webmail and the office CRM exactly as the user sees them. Most extensions are honest. But extensions get sold — a popular free add-on is bought by an unknown company and updated into an ad injector or data collector overnight, and the user notices nothing because the icon never changes. Add abandoned add-ons that never receive security fixes, and the unmanaged extension list is a risk your antivirus never even looks at. This guide shows how to audit it with Browser Security Plus and replace the free-for-all with a short, deliberate allow list.
Three facts make extensions different from ordinary software. First, the permission is the product: to do its job, an extension often genuinely needs to see page content — which means a bad one sees everything. Second, ownership changes silently: stores do not announce that your add-on was sold last Tuesday. Third, nobody updates the list: the extension installed for one task in 2023 is still running, unreviewed, in 2026. None of this means banning extensions — the office password manager and accessibility tools are extensions too. It means the list should be a decision, not an accident.
Use the Browser Security Plus console to list extensions per computer, with their permissions. Sort by the scary column first: anything that can read all sites, anything not updated in over a year, anything nobody can explain. You will find duplicates (three PDF tools), orphans (the add-on of an employee who left), and usually one or two things that should never have been there. Removing the unexplained ones after a quick word with the user costs nothing; doing it before you have the full list just teaches users to hide them.
An allow list written by IT alone will be wrong in both directions. Walk the departments: accounts needs the bank's add-on, design needs the colour picker, everyone needs the password manager. Write the list down — name, publisher, purpose. Then deploy it through the console: approved extensions are silently distributed to every managed browser, and anything not on the list is blocked from installing. New requests become a small form and a two-day wait instead of a permanent hole. Keep the list short enough to fit on one page; a forty-item allow list is just the old problem with a stamp on it.
For the extensions already installed and not approved, the console can remove or disable them centrally instead of a desk visit per PC. Do it in this order: first the ones with no updates and all-site permissions, then known ad injectors and fake "security" add-ons, then the merely useless. Tell staff a week ahead which day the cleanup happens and what is going — people forgive losing a coupon finder; they do not forgive surprises. After removal, re-scan the inventory in a fortnight: an extension that comes back by itself is a sign of a bundled installer or a sync account re-installing it, which is a different problem worth knowing about.
Two settings keep the list clean afterwards. Browser sync: a user signed into Chrome with a personal Google account pulls their home extensions onto the office PC automatically — decide as an office whether personal sync accounts are allowed on work browsers at all. Developer mode and sideloading: extensions installed from files or random websites bypass the store entirely; block them by policy. Neither setting is rude — both simply say the office browser is a work tool with a managed list, the same way the office PC has managed software.
An allow list controls known browsers on managed computers. It does not follow the user to a personal laptop, and a portable browser carried on a pen drive is a separate problem (your USB and software policies are the answer there, not this console). Within its territory, though, extension control is complete and provable — and for most offices, that territory is where the banking and the email actually happen.
The extension audit and allow list, shown live in the console — including the permission view most admins never open.
▶️ Watch Full VideoA malicious one can read what is on the screen, because its permission — read and change data on all websites — is exactly that power. It sees the password as you type it into the page, before any encryption. That is why the audit matters even when every extension looks friendly: the permission, not the icon, is the risk.
No — a total ban usually fails and pushes users to worse workarounds. Some extensions are genuine work tools, including the office password manager. The working model is a short allow list: approved extensions are installed automatically by policy, everything else is blocked, and new requests get a quick review.
They stay until your policy acts on them, so plan the removal as its own step: audit from the console, announce the date, remove the unapproved ones centrally, then verify with a fresh inventory scan. Anything that reappears on its own points to browser sync or a bundled installer — chase that separately.