Make browser state part of the asset inventory
Name the browser-policy owner and record the profiles used for company administration, personal browsing and development. Inventory installed extensions by exact identity, publisher, purpose and permissions. Include extensions delivered by desktop applications and those synchronized through a browser account. A list of approved names is insufficient when a similarly named extension or a different publisher can be installed.
Keep sensitive administration in a profile with a deliberately small extension set. For higher-impact operations, use a separate managed device as well. Profile separation reduces accidental mixing but is not a strong containment boundary against malware running as the operating-system user. Record which accounts sync browser data so recovery credentials and extensions are not unintentionally copied into a personal environment.
Review permissions against the actual job
Chrome’s extension documentation distinguishes API permissions, host permissions and content-script match patterns. Use those distinctions when reviewing an extension: a tool intended for one site should not receive broad access without an explained need. Prefer optional or site-limited permissions where the extension supports them. Review requests for new permissions as a fresh security decision rather than a routine update click.
Google’s management guidance explains how users can inspect extension site access and remove extensions. Our operating procedure is to document the minimum needed access, verify it in the browser and remove unused extensions promptly. An extension-store listing is a distribution and review signal, not proof that the publisher, account or every future update will remain trustworthy.
Contain session exposure as well as extension code
If an extension is suspected, preserve its identifier, version, installation source, effective permissions and relevant alerts. Disable or remove it through the managed process and establish whether its permissions included sensitive sites. Do not stop the investigation at a malware scan: the code may have read page data, altered a destination or accessed an authenticated application while it was running.
Use a clean browser or device to revoke potentially exposed sessions and review account actions, authentication factors and application grants. Change credentials when appropriate to the evidence and scope. Investigate the browser account that could reinstall or synchronize the extension. A clean profile that immediately restores every old extension is not a reliable recovery step.
Test the policy with harmless changes
On a test user and approved browser, install a benign extension requiring an out-of-policy permission. Verify that the policy blocks installation or routes a meaningful approval request. Check that inventory captures the attempted or successful change. Test removal and ensure synchronization does not silently reinstall it. Keep this exercise away from production sessions and real wallet accounts.
Review sensitive profiles after role changes, device replacement and browser-policy updates. Confirm browser patch status and cleanup abandoned profiles with the owner’s involvement. Record exceptions with a reason, expiration and compensating control. The standard is a short, explainable set of extensions and a demonstrable process for recognizing and containing unwanted changes.
Controls to take away
- Extension permissions are part of application-session risk.
- Profiles organize activity; they do not defeat host-level compromise.
- Recovery must review synchronization that can reinstall an unwanted extension.
Take this to your next review
Working checklist
Use this as a starting point, then assign owners and record evidence in your team's own system. Checks here reset when you leave or reload this note.
0 of 5 reviewed
Sources & further reading
The references below support this note. Adapt the procedures to your systems, access model and recovery requirements.
A correction or a better primary source? Send Raiders the article URL and evidence. Editorial policy.