Are Browser Extensions Safe for Business? The Myths, Checked

The myth: Google reviewed it, thousands of people use it, so it must be fine.

A Chrome Web Store listing means the extension passed review when it was submitted, and its publisher can push new code at any time afterward. Updates install automatically, so a trusted extension can turn hostile overnight if the developer's account is taken over, and nothing on the employee's screen changes.

The clearest case is Cyberhaven, a data security company. According to LayerX's analysis of the campaign, a Cyberhaven employee was phished on December 24, 2024 with an email dressed up to look like it came from Google, and approved a malicious OAuth app instead of handing over a password. A poisoned version of the Cyberhaven extension went out through the store in the early hours of December 25 and was pulled in the early hours of December 26. LayerX says the code went after cookies and authentication tokens for Facebook, and that the extension had over 400,000 users.

Cyberhaven was one of more than 25 extensions LayerX tied to the same campaign, with a combined install base of over 2.3 million users. A security product, delivered through the official store, did the stealing. Store review is where your own review starts, and the publisher's account security is something you inherit the day you click install.

For a Houston business, the practical rule follows directly. An extension that IT placed on an allowlist can still go bad, but it sits on one list and can be pulled from every managed machine at once. An extension an employee added on their own gets found during the cleanup, if it gets found at all.

The myth: We are a small office, and IT would notice if something odd showed up.

Most small businesses cannot produce a list of the browser extensions on their computers. Google's own Chrome admin documentation says that in the default allowed mode, users can install apps and extensions from the Chrome Web Store, so no administrator is involved unless a policy changes that default.

LayerX's Enterprise Browser Extension Security Report 2025, built from its enterprise customers' browsers plus public store data, shows how far that default reaches:

• Nearly every user, 99%, has at least one extension installed.
• Just over half of users, 53%, have installed an extension with a high or critical permission scope, the kind that can reach sensitive data.
• More than half of extension publishers, 54%, are identified only by a free webmail account such as Gmail.
• About half of extensions, 51%, have not been updated in over a year.
• A quarter of enterprise extensions, 26%, were sideloaded rather than picked from a store page.

In 35+ years doing this, one pattern has held: a business cannot remove what it never wrote down. In the onboarding audits we run for Houston businesses, the extension list is almost never recorded anywhere, and the first export tends to surface tools nobody remembers adding. The 2026 Comcast Business Cybersecurity Threat Report logged 5.8 million browser session hijacking and extension events, 95.1% of them malicious browser extensions, while noting that its raw totals measure visibility rather than confirmed attacks.

An inventory is the cheapest control on this page. Export the extensions from every managed Chrome and Edge profile, put an owner and a business reason next to each one, and anything without both becomes a candidate for removal.

The myth: The password manager is a security tool, so its extension is the safe one.

A password manager extension is still worth running, and its settings still need checking. Security researcher Marek Tóth tested 11 password manager extensions and found all of them vulnerable to DOM-based extension clickjacking in their default configuration, where a disguised page element tricks one click into filling saved data.

Tóth presented the research at DEF CON 33 on August 9, 2025. The attack hides the password manager's own autofill menu beneath something harmless on a page the attacker controls, so a single click fills a login, card number or one-time code into that page. He put the exposure at tens of millions of users. His fix-status update dated January 14, 2026 lists most vendors as fixed, with 1Password and LastPass still shown as vulnerable at that date.

His recommended settings cost almost nothing to apply across a whole office. In Chromium browsers, set the extension's site access to on click. Limit autofill to exact URL matches, which narrows subdomain exposure. Where the product allows it, turn off the inline autofill menu and copy and paste instead.

For a Houston CPA practice working toward the March 15 and April 15 filing deadlines, the extra click costs a second or two per login. Pushing these settings by policy, so no preparer has to remember them in the middle of tax season, is the part an IT provider should own.

The myth: We turned on MFA everywhere, so a stolen password or a sketchy add-on cannot get anyone in.

MFA protects the sign-in, and the session cookie the browser receives afterward is what keeps the user signed in. An extension with permission to read cookies can copy that cookie, and whoever replays it is treated as the user who already passed MFA, with no second prompt.

The Cyberhaven payload described by LayerX went after cookies and authentication tokens for Facebook business accounts, which is session theft in practice. The password was never the target. MFA did its job at the front door, and the copied cookie walked in behind it.

Session theft also changes the legal math for a Texas business. If a stolen session reaches client records that pair names with Social Security, driver's license or financial account numbers, Texas Business and Commerce Code Section 521.053 requires notice to affected individuals no later than the 60th day after the business determines a breach occurred, and notice to the Texas Attorney General within 30 days when at least 250 Texans are involved. The Texas breach reporting checklist walks through both clocks. Phishing-resistant sign-in helps at the front door; keeping cookie-reading extensions off company browsers is what closes this particular path.

CinchOps is a managed IT services provider based in Katy, Texas, serving small and mid-sized businesses across the Houston metro area. CinchOps specializes in cybersecurity, network security, managed IT support, VoIP, and SD-WAN for businesses with 10 to 200 employees.

The extension review CinchOps runs sorts every extension on two questions: how much the extension can reach, and how clearly its publisher can be identified. Narrow access from a named publisher that has updated within the year gets allowed. Broad access the business needs for daily work gets allowed with review and is re-checked whenever its permissions change. A low-access tool from an unknown publisher gets replaced with a vetted alternative or a built-in feature. Anything that reads every site and comes from an unknown publisher gets removed and blocked by policy.

• Through managed IT support, CinchOps pushes the Chrome and Edge extension policy to managed machines and keeps the inventory current, and a request to approve a new tool reaches a help desk that responds in under 15 minutes.
• Through cybersecurity services, 24/7 threat monitoring watches for unusual sign-ins and session activity, including outside office hours.
• Businesses in Houston, Katy and Sugar Land get the same policy on every managed machine, whether staff work in the office or from home.
• Law firms, CPA firms and engineering firms get an allowlist built around the portals and line-of-business tools they actually sign in to every day.
• Pricing is a flat monthly rate per user, $100 to $250 per user per month, on Zero-Zero-Zero terms: no long-term contracts, no hidden fees, no cancellation penalties.

Are browser extensions safe for business? The ones on an allowlist with a named owner are a reasonable, managed risk, and everything else is a guess. If nobody at your company can say today which extensions your staff are running, start there, and talk to CinchOps about pulling that list.