The Extension Nobody Reviewed: The Attack Surface Hiding in Every Employee's Browser

The most dangerous software on your company's laptops isn't the app IT approved. It's the PDF merger someone installed from the Chrome Web Store in 2023, used once, and forgot about — because it's still running today, still asking for "read and change all your data on all websites," and still getting zero reviews.

Browser extensions are third-party software with root-level access to everything you do in the browser: your webmail, your admin panel, your invoicing tool, the form where customers type card numbers. They just happen to be the kind nobody counts, because installing one takes four seconds and no approval. When an extension goes bad — abandoned upstream, sold to a new owner, or malicious from day one — it doesn't need to hack anything. It was already inside, with permission to read every page you visit.

Here's the quarterly pass that turns that blind spot into a controlled list. It's about 30 minutes.

1. The inventory walk (ask the browser, not the person)

"Which extensions do you use?" gets a guess. chrome://extensions and Firefox's Add-ons Manager get the truth. Export the list per person: name, version, date added, permissions.

Three things to flag immediately:

• Unknown install dates — an extension added two years ago by someone who left is exactly the kind that stops getting updated and starts getting quietly sold.
• Out-of-store installs — side-loaded .crx files and "developer mode" unpacked extensions are how malware usually arrives. Explain or remove today.
• A count that only grows — if the pile never shrinks, nobody is culling, and privileged code with compound interest is what you're running.

2. The permission walk (the part that actually matters)

"Read and change all your data on all websites" is root access. Some tools genuinely earn it — password managers, screenshot tools. An ad-blocker copycat that doesn't need it, or a shopping-coupon assistant that wants it, is the pattern behind most extension-hijack stories.

Match permissions to the job: a tab manager that reads page contents, a note-taker with clipboard access, a theme that wants anything — each mismatch is over-privileged or a red flag. And hold anything that can read webmail to the highest bar in the review, because your inbox is the front door for phishing and invoice fraud.

The one question that catches most bad ones: "Would I still install this today if I read the permissions out loud?" If the honest answer is no, it stays no even though it's already installed.

3. The zombie purge

• Kill anything abandoned upstream. An extension untouched for 18+ months is unpatched code with full page access — and abandoned tools are the ones most likely to change hands to a hostile new owner. One "analytics update" from the new maintainer and every user's page content starts flowing somewhere new.
• Kill anything unused. The one-project converter from 2023 is dead weight with live permissions. "Used once, installed forever" is the default; the purge is how you reverse it.
• Kill duplicates. Three ad blockers triple the privilege surface and slow every page load. Keep the best.

A calendar event titled "extension purge," 30 minutes, four times a year. That's the whole system.

4. The update-and-change watch

Automatic updates on (defaults to on in Chrome/Edge). Skim changelogs at major versions — ownership changes are when benign tools historically go bad. And watch for permission creep after updates: Chrome flags newly requested permissions, and a calculator that suddenly wants to read all website data didn't grow features, it grew reach. Remove unless proven.

Keep the approved list written down — allowed extensions, who approved them, when. Future audits become a diff instead of archaeology.

5. Policy for the humans (four sentences)

1. Official store only — never a "download here" link, never a shared .crx.
2. New extension = one-line ping in the team chat: "Adding X, it needs Y." Not approval theater — a paper trail.
3. Never install an extension to fix one task once. Do the one-off manually.
4. Company machines get a managed work profile with only approved extensions, kept separate from the personal one. 80% of the control, none of the surveillance-software vibes.

The 15-minute version

Open every browser's extension page once this quarter. Delete everything unrecognized, unused in 90 days, or wouldn't-reinstall-today. Check "last updated" on survivors. Write the one-line policy. Next quarter it gets faster.

---

The full checklist with the per-person audit table (extension, permissions, verdict, owner) is in the Browser Extension Security Checklist — part of the free HIVE80lab ops-notes library. If you want the quarterly re-run to happen without anyone remembering to remember, the Ops Starter Kit ($14) includes the audit sheets, and launch week code HIVE-LAUNCH30 takes 30% off any paid kit.