the app inside every tab

Most access reviews look at accounts: who can sign in to what. Browser extensions never appear in them, although many can read and change every page a person opens, including the ones they are already signed in to. An extension with that reach sits inside the email, the CRM, the banking portal and the admin console at once, with the user’s own session.

Extensions also change without anyone deciding to change them. Chrome checks for updates every few hours, according to Google’s developer documentation, and an update that asks for no new permissions installs without a prompt. Whatever the extension does today, it does because its maker published it, and tomorrow it does whatever the maker publishes next.

two ways a trusted extension turns

The maker’s account is taken. On 24 December 2024 an employee of the security company Cyberhaven granted store-publishing access to an app posing as a Chrome Web Store policy tool. A malicious update went out on 25 December and, according to researchers, collected browser session data for about a day before Cyberhaven replaced it. Sekoia linked the same phishing to at least 16 other extensions. The case is in the Cyberhaven incident.

The extension is handed to someone else. The Great Suspender, a popular tab manager with about 2 million users according to LWN, passed to a new maintainer in 2020. Later versions added code that users flagged as suspicious, and Google removed it as malware in February 2021, disabling it in users’ browsers.

what an approved extension can do after an update

1. 1installed onceA useful tool, approved by IT or added by the user.
2. 2broad reachPermission to read and change the pages the user opens.
3. 3silent updateNew code, same permissions, no prompt.
4. 4inside the sessionIt reads what the logged-in user reads, in every tab.

An extension is whatever its latest update says it is.

why nobody counts them

They install like bookmarks. A user can add most extensions in two clicks, without admin rights and without a ticket. Unless the company has set a policy, IT has no record of them.

The permission prompt is read once. Chrome shows a warning such as “Read and change all your data on all websites” at install time for some permissions. After that the extension keeps the permission. Google’s documentation says that an update adding a new warning-level permission disables the extension until the user accepts, and an update that adds none passes silently. The Cyberhaven update added none.

They sit outside sign-in controls. Two-step login, single sign-on and conditional access all protect the moment of signing in. An extension works after that moment, inside a session that is already trusted. The token guide covers why a session keeps working after the conditions that created it.

what narrows it

Switch to an allowlist. Chrome and Edge both support blocking all extensions by default and allowing a named list, through the ExtensionInstallBlocklist and ExtensionInstallAllowlist policies or the equivalent settings in Google Admin. Microsoft’s documentation notes that adding an already installed extension to the blocklist disables it.

Block the broadest permissions. The ExtensionSettings policy can block specific permissions, so that extensions requiring them will not install or load. Google’s admin help also describes stopping extensions from reading or changing chosen sites, such as your email, banking and admin consoles, through runtime_blocked_hosts.

Keep the list short and owned. Each allowed extension needs a reason and a person who answers for it. Ten well-known extensions are easier to watch than eighty.

Accept what the controls cannot do. None of these policies stops a malicious update to an extension you have already allowed, because the update arrives under the same name with the same permissions. That is why the list should be short, and why the sites that matter most should be blocked to every extension that does not need them.

the question to take to your team

Which extensions are running in the browser your finance director uses to approve payments, and who decides what their next update contains?