Browser Extensions: Check Before You Add One

Browser extensions can be genuinely useful.

They can help with spelling, screenshots, passwords, PDF tools, meetings, shopping, productivity, and many other everyday office tasks. Because they install inside the browser, they often feel small and harmless.

But a browser extension can also see more than people expect. Depending on its permissions, an extension may be able to read or change information on websites you visit. That can matter if staff use the same browser for email, Microsoft 365, Google Workspace, banking, accounting, supplier portals, customer systems, or social media.

The safest habit is simple: treat browser extensions like software, not decorations.

Why extensions deserve a second look

An extension may ask for permission to:

read and change data on websites
view browsing activity
access copied text, downloads, or page content
run on every site instead of only one trusted site
update itself later without the user noticing the change

Most extensions are not malicious. The risk is that staff may install too many, choose one from an unknown developer, accept broad permissions without reading them, or keep an old extension long after it is needed.

For a small business, this can quietly increase risk. A risky extension in the wrong browser session could expose email content, login pages, invoice portals, cloud files, or customer information.

Before installing an extension

Pause for a quick check before adding anything to a work browser.

Ask:

Do I actually need this for work?
Is it from a known, reputable developer?
Does it have a clear purpose and recent updates?
Are the permissions reasonable for what it does?
Does it need access to every website, or only one site?
Has IT or management approved it for business use?

A calculator extension should not need broad access to every page you visit. A screenshot tool may need more access, but it should still come from a trusted source and be used only where needed.

Good habits for office staff

Use these practical rules:

Install extensions only from official browser stores.
Keep the number of extensions low.
Remove anything you do not recognize or no longer use.
Review extension permissions every few months.
Use separate browser profiles if your company separates work and personal browsing.
Ask IT before installing extensions that affect email, passwords, documents, finance, or customer data.
Keep the browser updated so removed or unsafe extensions are blocked where possible.

If the browser offers a setting that lets an extension run only when clicked, or only on specific sites, choose the narrower option when it still works.

What not to do

Avoid these shortcuts:

Do not install an extension just because a website popup recommends it.
Do not approve broad permissions without reading them.
Do not use personal shopping, coupon, video-downloader, or entertainment extensions in a work browser.
Do not keep old extensions “just in case.”
Do not ignore browser warnings about an extension being removed, unsupported, or unsafe.
Do not install a different extension with the same name from an unknown developer if the original disappears.

Convenience is useful, but it should not create unnecessary access to business data.

If you are unsure

If you are not sure whether an extension is safe, stop before installing it.

Send the extension link to your manager or IT support and explain what you need it for. If the extension is already installed and something seems strange — unexpected popups, changed search pages, login prompts, redirects, or warnings — disable it and ask for help.

If you think an extension may have seen passwords, banking pages, email, or business systems, report it quickly. Early reporting gives the company time to remove the extension, check affected accounts, reset passwords where needed, and look for unusual activity.