A browser add-on helps an employee format text or capture a page. It also asks to read and change data on every website they visit. When that browser is used for company email, customer records and supplier portals, approving the extension becomes a business-access decision.

Start by finding which extensions exist, why people need them and which data they can reach. This guide uses Chrome's documented controls as an example. Other browsers and management platforms need their own verified procedures; a Chrome setting should not be assumed to cover every device.

The artwork is a conceptual extension-access review, not an authentic browser settings screen or a depiction of an ITZ customer environment.

Separate useful capability from appropriate access

The Chromium extensions security FAQ explains that extensions can access sensitive site data when they have the relevant permissions. That access can be part of their intended functionality. A legitimate password manager, for example, needs capabilities that would be inappropriate for an unrelated cosmetic tool.

Assess the extension's purpose, publisher, requested permissions, privacy disclosures and business necessity together. A familiar name or a useful demonstration does not explain why a tool needs access to finance and HR sites. Equally, a broad permission warning is not by itself evidence that an extension has stolen information.

Build an inventory that someone owns

For each work browser profile, record the extension name and unique identifier, publisher, business owner, reason for use, permissions, permitted sites and whether installation is controlled by policy. Separate corporate profiles from personal profiles. A review of one laptop is not an inventory of the organisation.

Ask employees about dependencies before removing tools: a quotation workflow may rely on an approved signing extension, while an old screen-capture add-on may no longer be needed. Prioritise extensions with unexplained publishers, no accountable owner or access broader than the stated task.

A business cybersecurity review covering browser add-ons and data access can help define the approval rule and exceptions. Request a Browser Extension Access Review to discuss work devices, browser management and the applications employees use.

Reduce site access where the workflow permits

Google's extension-management instructions describe reviewing an extension's Details and changing site access. Available choices include access when selected, on specific sites or on all sites. Test the narrower scope with the person performing the business task.

For an illustrative case, a tool needed only on an approved content-editing site should be evaluated for that site's access rather than automatically permitted everywhere. Record the observed result: did it still perform the task, and did it remain inactive on an unrelated test site?

Google also notes a limitation: site-access changes affect matching host permissions, and do not control lower-level VPN or proxy access in the same way. Treat site restrictions as one control, not a complete sandbox for every extension capability. Review other permissions separately.

Use central policy only after checking coverage

Chrome Enterprise's allow/block guidance describes policies for managed browsers and users. Verify enrolment, policy scope and administrator authority before claiming a rule covers the company. Confirm the effective setting on a representative device, including a device used away from the office.

The managed extension-request workflow supports employee requests and administrator decisions, with specific management prerequisites. Plan the allowlist before enabling restrictions and pilot with a small group. Blocking required tools without an approval route can interrupt work and encourage informal workarounds.

If management coverage is incomplete, document that gap and define interim ownership. device management and employee-device onboarding can support an inventory and staged rollout. Do not ask employees to bypass centrally enforced controls to make a local test pass.

Check removal, exceptions and incident handling

  • Confirm that approved extensions still support essential sign-in, document and customer-service tasks.
  • Verify that restricted or removed extensions are actually restricted or absent in the target profile after policy application.
  • Give each exception an owner, reason and review date.
  • Check new permissions and business need again when a tool changes materially.

If an extension is suspected of exposing data, preserve its identifier, version, affected profiles and relevant evidence for the authorised incident process. Removing it does not retract data already disclosed. Credential or session remediation depends on the actual exposure and should be decided by the responsible security team. The remote-support access review covers a separate route that may also need attention.

Request a Browser Extension Access Review to discuss an inventory, approval criteria, permitted-site testing and a staged policy rollout. Share the business context in the form below, without passwords, customer records or sensitive browser exports.

Google and Chromium documentation reviewed 23 October 2026. Examples and review steps are proposed business controls, not findings about your environment.