Browser extension security checklist for small teams: the attack surface hiding in every employee's Chrome

Every laptop in your company runs a browser, and every browser runs a small pile of third-party code with alarming privileges: read every page you visit, capture what you type, see your webmail, your admin panels, your invoice tool. Extensions are third-party software — they're just the kind nobody counts because installing one takes four seconds and no approval. This checklist is the quarterly pass that turns that blind spot into a controlled list.

1. The inventory walk (thirty minutes, once per quarter)

• Ask the browser, not the person. "Which extensions do you use?" gets a guess. chrome://extensions, edge://extensions, and Firefox's Add-ons Manager get the truth. Screenshot or export the list per person: name, version, date added, permissions.
• Flag the unknown dates. An extension installed two years ago by someone who left the company is exactly the kind of thing that stops getting updated and starts getting quietly sold. Date-added is your best lead.
• Check the install source. Web Store installs are auditable; .crx side-loads and "developer mode" unpacked extensions are how malware usually arrives. Anything installed outside the store gets explained or removed today.
• Note the count. The number matters less than the trend — if it only grows quarter over quarter, nobody is culling, and a growing pile of privileged code is a liability with a compound interest rate.

2. The permission walk (the part that actually matters)

• "Read and change all your data on all websites" is root access. Some tools genuinely need it (password managers, screenshot tools). An ad-blocker copycat that doesn't, or a shopping-coupon assistant that does, is the pattern behind most extension hijack stories.
• Match permissions to the job. A tab manager that wants to read page contents, a note-taker that wants clipboard access, a theme that wants anything at all — each mismatch is either an over-privileged build or a red flag. Keep what earns it; cut what doesn't.
• Pay special attention to anything that can read webmail. An extension that can read every page can read your inbox, and your inbox is the front door for phishing and invoice fraud. Mail-adjacent extensions get held to the highest bar in the review.
• The one question that catches most bad ones: "Would I still install this today if I read the permissions out loud?" If the honest answer is no, it stays no even though it's already installed.

3. The zombie purge (extensions that quietly rot)

• Kill anything abandoned upstream. Check the store listing's "last updated" date. An extension untouched for 18+ months is unpatched code running with full page access — and abandoned extensions are the ones most likely to change hands to a new, hostile owner. This is the same risk model as the vendor review, compressed into a browser tile.
• Kill anything unused. The PDF merger from one project in 2023 is dead weight with live permissions. "Used once, installed forever" is the default behavior; the purge is how you reverse it.
• Kill duplicates. Three ad blockers fight each other, triple the privilege surface, and slow every page load. Keep the best one, delete the rest.
• Re-run the purge quarterly. Extensions accrete like browser tabs. A calendar event titled "extension purge" — 30 minutes, 4 times a year — is the whole system. It's the same ritual shape as the annual security review, just on a shorter loop.

4. The update-and-change watch

• Turn on automatic updates (Chrome and Edge default to on; Firefox is a settings toggle). An un-updated extension is a known-vulnerable one waiting for a scan.
• Skim the changelog at major versions. When an extension jumps a full version or changes hands, the store listing usually says so. Ownership changes are when benign tools historically go bad — the new maintainer ships one "analytics update" and every user's page content starts flowing somewhere new.
• Watch for permission creep after updates. Chrome flags newly requested permissions. A calculator that suddenly wants to read all website data didn't grow features — it grew reach. That's a remove-unless-proven moment.
• Keep the approved list short and written down. A one-page doc: allowed extensions, who approved them, when. It turns future audits from archaeology into a diff, and it's the sheet that makes onboarding say "these are the ones you may install."

5. Policy for the humans (four sentences, no lectures)

• Install from the official store only — never from a "download here" link, and never a shared .crx file. The store isn't perfect, but it's the difference between an audited install and a coin flip.
• New extension = one-line ping. "Adding ______, it needs ______" in the team chat. Not approval theater — a paper trail and a moment of "wait, does that need that?"
• Never install an extension to fix one task once. The bulk-converter used a single time is the classic infection vector; do the one-off manually and skip the install.
• Company machines get a managed profile where it matters: a work browser profile with only approved extensions, kept separate from the personal one. You get 80% of the control for none of the surveillance-software vibes.

The 15-minute version (if you do nothing else)

• Open every browser's extension page once this quarter — today is fine.
• Delete everything you don't recognize, haven't used in 90 days, or wouldn't install again.
• Check "last updated" on the survivors; abandon anything stale with broad permissions.
• Write the one-line install policy in the team channel. Done. Next quarter, repeat — it gets faster every time.

The Ops Starter Kit ($14) includes the audit sheets that turn this checklist into a per-person table — extension, permissions, verdict, owner — and the Automation Starter Pack ($19) puts the quarterly re-run on a schedule so the purge happens without anyone remembering to remember. Launch week: 30% off any paid kit with code HIVE-LAUNCH30 at checkout.