How to Protect Your Business Data from Unsafe Browser Extensions

Article Summary: Browser extensions can read confidential information on websites where they have the necessary access, including pages you open after signing in. Reviewing their publishers, permissions, and data collection helps you decide which tools suit your work. You can then remove unnecessary extensions, restrict website access where supported, and manage which new tools staff can install.

You’ve found a browser extension that looks useful for work. Perhaps it can capture a whole webpage in one screenshot, or help you check an email before you send it. You’re ready to install it when the browser asks for permission to read and change data on the websites you visit.

If you also use that browser to read customer emails or open employee records, the extension’s access could include those pages. An extension with permission to read a page can also read what you see after signing in.

Browser extension access limits

Extensions add features to browsers such as Chrome, Edge, and Firefox. To provide those features, some need permission to work with the websites you open. The access they request can be limited to particular sites or cover a much wider range.

An extension with the right permissions can read and change a webpage's content. Mozilla explains that website permissions can also include information you enter into a page, such as usernames and passwords.

Website access alone doesn’t let an extension open every file on your computer.

A password manager needs to recognize sign-in pages and fill in your details, and some ad blockers need to inspect page content to hide ads. If the reason isn’t clear from the listing, your IT provider can check with the developer before you approve the tool.

Extension publishers and data privacy

If you’re adding an extension for software you already use, the software company’s own website is a good place to find the correct listing. Follow its link to the extension store and check the publisher’s name. That helps you avoid choosing a different tool just because it has a similar name or logo.

Mozilla checks extensions submitted to its store for common issues and may also have a person review them. Its guidance warns that those checks don’t guarantee that an extension is completely safe.

If you’re asking a tool to check an email, you’d expect it to read that email. You’ll also want to know whether it sends a copy to its provider and what happens to the text then. The privacy policy should help explain what information the company collects, how it uses it, and how long it keeps it.

You might be happy using a tool on public product descriptions but not on confidential customer emails. You could ask the provider, “If our staff use this while replying to a customer, what information will your company receive?” If you can’t get a clear answer, don’t use it on confidential emails until IT has checked how it handles them.

Installed browser extensions

An extension installed for one project can remain in a browser long after the work is finished. It’s worth checking what staff already have installed, including tools they tried once and no longer use.

Your IT provider can put together that list, covering each browser used for work. Alongside each extension’s name, publisher, and permissions, record who uses it and what they use it for.

If an employee says, “Customers keep sending files I can’t open, so I use this converter,” they’ll need another way to open those files. You can check whether approved software already does the job, or have IT review a replacement before removing the tool they rely on.

Mozilla recommends reviewing installed extensions periodically and removing those you don’t use. Check unfamiliar names with IT first, though, because an extension you don’t recognize could be something they installed for security or another business requirement.

Website access restrictions

Suppose you use an extension to check text on your company website. IT can test whether it will work with access limited to that site, keeping it off unrelated pages such as your accounting system.

Chrome lets you choose when and where an extension can read and change site data. Depending on the extension, you can allow access when you select it or limit it to specified sites, rather than allowing it across all sites.

Have IT try the restriction with staff who use the affected tools before applying it across the business. Include everyday tasks such as signing in with the approved password manager, so you can see whether the restriction stops something people need to do.

For an extension that controls VPN or proxy settings, have IT check its network access separately. Google says changing website permissions doesn’t restrict that access.

Extension approval rules

For browsers your IT provider manages, Chrome and Microsoft Edge support rules that allow approved extensions and block others.

The rules need to cover each browser staff uses for work. An Edge policy won’t apply to Chrome, so IT should check the setup in each browser.

Staff need to know who to contact when they find a tool they’d like to use. They can send that person the store link and explain the job they’re trying to do. IT can review the permissions and data collection, then explain whether the employee can use the extension or needs an approved alternative. An extension needed by one department doesn’t have to be installed for everyone.

Updates and permission changes

An update can add a feature that needs more access to your data. Before anyone accepts new permissions, IT should check what changed and whether the business needs that feature.

Chrome can disable an extension after an update if it adds a permission that triggers a warning. It stays disabled until the user accepts the new permission.

An extension can also change how it uses permissions you’ve already granted, without asking for anything new. That’s why reviews need to cover how the tool handles data, as well as any new permission requests.

Keep your browser and approved extensions updated, and include them in later reviews as your team’s needs change.

Suspicious extensions and security alerts

If your browser warns you about an extension, send a screenshot and the extension’s name to your IT provider. That includes alerts from Chrome’s Safety Check about potentially harmful extensions. If the browser has already blocked the tool, leave it blocked while IT checks it.

The store link and an approximate installation date can help too, if you have them. Your provider can check the tool's permissions and look for it on other work computers, then assess what information it could access while running.

Uninstalling the extension won’t delete information it has already sent elsewhere. IT will need to secure any accounts whose passwords were exposed. If the extension copied customer or employee information, your provider can assess what was involved and whether anyone needs to be notified.

Frequently Asked Questions

Are all free browser extensions unsafe?

No. Free and paid extensions need the same checks for their publisher, permissions, and data handling.

Can an extension read information behind a login?

Yes, if it has the necessary access to the page you open after signing in. That can include content in webmail or a customer system.

Why does our password manager need access to websites?

It needs to recognize sign-in pages and fill in your details. Check that you have the password manager’s official extension, rather than assuming any tool with a similar name comes from the same company.

Should we ban every browser extension?

Not necessarily. You can keep the tools your team needs and limit new installations to extensions the business has approved.

If you’re not sure what’s installed on your work computers, ask your IT provider to go through the extensions with you and explain the access they have. And if you don’t have an IT provider, you can always reach out to us, and we’ll help you out.

—

Image sources: All three images were created for this article using OpenAI’s image-generation tool. They are illustrations, not screenshots of a real browser.