Windows Update gets the attention. The operating system gets patched, the report goes green — while three browsers on the same PC sit four versions behind, carrying holes that were fixed, announced and exploited months ago. The browser is the most attacked software in the office, and its patch is the one nobody owns.
Here is the uncomfortable detail: modern browsers update themselves, so most admins assume the job is done. Then the audit runs. Browser Security Plus reports the browser versions across your computers, and the tail is always there — the PC whose Chrome has waited eleven weeks for a restart to finish its update, the old Firefox installed for one website in 2023 and never opened since (an unopened browser still carries its holes when someone finally clicks it), the portable copy in a user's folder that no updater will ever touch. Attackers know this: browser vulnerabilities are exploited within days of disclosure, precisely because the patch exists but the restart does not. This guide closes that gap — find the laggards, decide their fate, and set the policy so the gap stays closed.
Three ordinary reasons, no villains required. The pending restart: Chrome and Edge download the update and wait for the browser to close; on a PC that sleeps instead of shutting down, "waiting" can last a season. The forgotten browser: self-update only runs when the browser runs; a secondary browser opened twice a year is a museum of patched-elsewhere vulnerabilities. The unmanaged copy: portable and user-installed browsers update on their own schedule or never, and standard patch reports often do not count them at all. Knowing which of the three you are looking at decides the fix — a restart nudge, a removal, or a policy.
From the console inventory, list browsers by version age per computer — Browser Security Plus tracks versions and also flags outdated plug-ins, the Java and PDF relics that deserve the same suspicion. Sort into three piles. Restart-pending: update downloaded, needs a browser restart — a message to the user fixes these today. Broken updaters: the update service is disabled or blocked — rare, and worth an IT visit because something changed that PC on purpose. Should not exist: the forgotten and portable browsers — these are not patched, they are removed, which is the subject of the next step.
Every installed browser is attack surface that must be maintained. If the office standard is Chrome and Edge, then the honest question for the third and fourth browsers is not "is it updated?" but "why is it here?" Remove unused browsers during the same cleanup pass as the rogue extensions — announce it, give a week for someone to claim a genuine need (the one bank site that only works in Firefox is real, and gets an exception plus a place on the update watchlist), then uninstall the rest centrally. Fewer browsers, all current, beats many browsers, mostly current, every single time.
Policy can enforce what reminders cannot: browsers set to update automatically with the setting locked against user changes, and — in managed environments — a relaunch notification that grows less polite as the pending update ages. Pair it with the human arrangement that makes it survivable: updates land when they land, but the forced-restart deadline is days, not hours, and never during the office's known peak (month-end closing is not the time to discover a restart policy). If your office also runs Endpoint Central, align the browser policy with its patch reports so the browser stops being the one application missing from the green dashboard.
Add one line to the monthly patch review: browsers older than two releases: target zero. The console report makes it a two-minute check. The number will not stay zero by itself — a new laggard appears whenever a PC sleeps through a month — but a number that is read monthly never becomes the five-month Firefox again. That is the whole secret of patching, for browsers as for everything else: not a perfect tool, a short list, read on schedule.
Version reports, plug-in checks and update policy — the video walks through the console views used in this guide.
▶️ Watch Full VideoBecause self-update finishes only when the browser restarts, and on office PCs that can take weeks. The policy does three jobs the updater cannot: it finds the PCs stuck in that waiting state, it removes the forgotten second browsers that never run their updater, and it proves — with a version report — that the fleet is actually current, instead of assumed current.
If nobody has a real job for it, yes — an unused browser is unpatched attack surface. The exception is genuine: a specific bank, government or vendor site that only works in one browser. Keep that browser, note why it exists, and put it on the update watchlist so its one job does not become its one hole.
Yes, with a deadline instead of an interruption: notify early, let the user pick the moment within a few days, and force only when the deadline passes. Set the deadline with the office calendar in mind — the goal is a current browser fleet with staff still on your side, and a restart during salary processing buys the opposite of both.