> For the complete documentation index, see [llms.txt](https://docs.stepsecurity.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.stepsecurity.io/developer-machines/browser-extensions.md).
# Browser Extensions
The **Browser Extensions** page gives you an organization-wide view of every extension installed in your developers' browsers, what each one is currently permitted to do, and which machines it is running on.
Extensions run inside the browser your developers sign into source control, cloud consoles, and internal applications with. An extension granted access to every site can read what is on the page. Reading the cookies that authenticate a session, or observing the requests the browser makes, requires additional API permissions on top of that host access. They are installed by individual developers rather than by IT, they update themselves silently, and they change ownership without notice, so an extension that was safe when it was installed is not necessarily safe today.
A summary at the top of the page shows how many unique extensions were detected across active devices, for example `Total 21 unique extensions across 11512 active devices`.
### Where to start
Three questions this page answers quickly:
* **Which extensions can see everything?** Select the **Global website access**, **Global script injection**, **Global cookie access**, or **Debugger access** capability chips. These are the extensions where one bad update reaches everything the developer does in that browser.
* **Which extensions did not come from a marketplace?** Set the store filter to **Self-hosted**, **No store**, or **Unknown**. **Self-hosted** confirms an update source outside the known stores. **No store** and **Unknown** mean provenance could not be established, which makes them useful investigation filters rather than proof that marketplace review was skipped.
* **Who is running a specific extension?** Search by name or extension id, open the result, and read the device list. When an extension is reported as compromised, this is the fastest path from an advisory to the affected machines.
### Filters
**Browser chips** scope the list to Chrome, Edge, or Firefox, each showing the number of unique extensions detected for that browser.
**Capability chips** scope the list to extensions holding a given capability, each with a count. Selecting more than one chip shows extensions holding any of the selected capabilities. Capability filters are then combined with the browser, engine, store, and search filters.
A capability listed for an extension across the fleet means the authority was confirmed on at least one device. An absent capability means it was not confirmed, which is not the same as the extension being safe. See [Capabilities](#capabilities).
The page also supports:
* **Search by ext name or ID**: free-text search across extension names and extension ids
* **All engines**: filter by browser engine, `chromium` or `gecko`
* **All stores**: filter by where the extension came from
* **Export CSV**: export the current filtered view
### The extension list
| Column | What it shows |
| ------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| **Extension** | The extension name, with its extension id beneath. See Unnamed extensions for entries with no recoverable name. |
| **Browser** | The browser it is installed in. The same extension installed in two browsers is listed once per browser, because the permissions each browser honours are its own. |
| **Store** | Where the extension came from. See [Store](#store). |
| **Capabilities** | The capabilities the browser is currently honouring. Where an extension holds more than the row can show, the remainder appear as a `+n` chip. |
| **Version** | The installed version, or `-` where the browser recorded none. |
| **Devices** | How many devices in your fleet have it installed. |
| **Last seen (GMT)** | When a device last reported it. |
### Capabilities
Capabilities describe what an extension can do with the permissions the browser is honouring for it right now. They are not what the extension asked for in its manifest, and permissions a developer has granted and later withheld are not counted.
| Capability | What it means |
| ------------------------------ | --------------------------------------------------------------------------------------------------------------- |
| **Global website access** | Granted host permissions cover effectively every website. This is host authority only and implies nothing else. |
| **Script injection** | Can run its own JavaScript inside web pages, but only on the specific hosts the browser has granted it. |
| **Global script injection** | Can inject its own JavaScript into effectively every website, unrestricted by host. |
| **Global request observation** | Can see the requests the browser makes on any site, including URLs and headers. Body access is not confirmed. |
| **Cookie access** | Can read cookies, including session tokens, but only on the specific hosts the browser has granted it. |
| **Global cookie access** | Can read cookies, including session and login tokens, on effectively every website, unrestricted by host. |
| **Browsing history** | Can read and modify the full browsing history recorded on the device, across every site visited. |
| **Debugger access** | Can attach the browser debugger to open tabs and inspect or control browser activity. |
| **Clipboard read** | Can read clipboard contents from an extension context, which may contain passwords and 2FA codes. |
| **Extension management** | Can inspect and, where allowed, enable, disable, or remove the other extensions in the browser. |
Each capability is derived from the evidence that capability requires. Some come from host permissions, some from browser API permissions, and some require both. Global script injection, for example, requires both a scripting permission and host access covering every site. An extension with the scripting permission but access to two named domains holds **Script injection**, not the global form. The detail panel prints the meaning of each capability beside its chip.
**Global script injection**, **Global cookie access**, and **Debugger access** are shown in red. **Global website access** and **Global request observation** are shown in amber. Red first, then amber, is the sensible order for a review.
{% hint style="info" %}
**No confirmed capabilities** means the collected data does not show the extension holding any of the tracked capabilities. It is not a safety verdict, and it also covers devices that have not reported since capability collection shipped in agent v1.16.0.
{% endhint %}
### Store
The **Store** column separates extensions that came from a vendor marketplace from those that did not.
| Value | Meaning |
| ----------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| **Chrome Web Store**, **Edge Add-ons**, **Mozilla Add-ons** | Attributed to that vendor's marketplace. Chromium extensions are attributed using known update URLs. A Firefox signature does not establish Mozilla Add-ons provenance, since a signed extension may also be self-hosted, so a Firefox extension's store origin may appear as **Unknown**. |
| **Self-hosted** | Updates from a server the publisher runs rather than from a marketplace. |
| **No store** | No vendor-store attribution. The collector also reports this for an unsigned Firefox add-on, which does not by itself prove the extension has no update source. |
| **Unknown** | The browser's record does not attribute it to any source. |
Anything other than a vendor marketplace is worth a look. **Self-hosted** confirms an update source outside the vendor's control. **No store** and **Unknown** mean provenance could not be established from the collected data, so treat them as candidates for investigation rather than as confirmed unreviewed extensions.
Sideloaded extensions, which a developer loads directly after turning on the browser's developer mode instead of installing from a store, are detected and reported like any other. Store provenance and installation method are recorded separately, so filtering the store to **Self-hosted**, **No store**, or **Unknown** surfaces extensions with non-marketplace or unestablished provenance rather than listing every sideloaded install. A sideloaded extension can still carry a recognised marketplace update URL.
### Extension details
Select any extension to open its detail panel.
At the top: **Devices**, **Versions**, and **Store**, the last linking out to the marketplace listing where the extension has one.
**Extension information** shows:
* **Engine**: `chromium` or `gecko`
* **Last seen at**: when a device last reported this extension
* **Capabilities**: each capability held, with its meaning beside it, or a statement that none were confirmed
* **Host permissions**: the collected URL patterns the extension holds access to, such as `https://extensions.gnome.org/*`. Long permission lists may be truncated.
* **API permissions**: the browser APIs the extension holds, such as `scripting`, `userScripts`, `declarativeNetRequest`, `nativeMessaging`, `tabs`, or `storage`
Host permissions and API permissions are the evidence behind the capability chips. Reading them together tells you not just that an extension can inject scripts everywhere, but which APIs it would use to do it.
#### Devices
At the bottom, **Devices** lists where the extension is installed:
* **By version** groups devices under each installed version. This is the faster view when an advisory names a specific bad version, or when you need the machines still on an older release.
* **All devices** lists affected devices individually with each one's version, flags, and when the install was last collected. The list shows the first 500 affected devices.
#### Flags
Flags qualify an individual install rather than the extension as a whole, and appear in the **Flags** column beside each device in the **All devices** view.
| Flag | What it means |
| -------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **All sites** | The install holds host access covering effectively every website on that device. This is the device-level view of the same grant that produces the global capabilities above. |
| **Developer loaded** | The install was loaded directly through the browser's developer mode rather than installed from a store. This is the reliable signal for a sideloaded install, and it is recorded per device. |
| **Preinstalled** | The browser shipped the extension itself rather than a developer choosing it. Google Docs Offline in Chrome is the common example. It is still a real extension with real permissions, so it is reported, but it is not evidence of anything a developer did. |
For Chromium installations, browser-cached marketplace state may identify an extension as **Delisted** or **Flagged**. Dev Machine Guard does not contact the marketplace during scanning, so those values may lag a store change until the browser refreshes its own metadata. They are returned by the device-specific inventory endpoint rather than in the device rows of the fleet extension detail, so they are not shown in the table above.
### Supported browsers
Chrome, Edge, and Firefox are covered, on macOS, Windows, and Linux. Extensions are read from each browser's own state files under the signed-in developer's home directory.
| Browser | Engine | macOS | Windows | Linux |
| --------------- | -------- | ---------------------------------------------- | ----------------------------------------- | -------------------------- |
| Google Chrome | Chromium | `~/Library/Application Support/Google/Chrome` | `%LOCALAPPDATA%\Google\Chrome\User Data` | `~/.config/google-chrome` |
| Microsoft Edge | Chromium | `~/Library/Application Support/Microsoft Edge` | `%LOCALAPPDATA%\Microsoft\Edge\User Data` | `~/.config/microsoft-edge` |
| Mozilla Firefox | Gecko | `~/Library/Application Support/Firefox` | `%APPDATA%\Mozilla\Firefox` | `~/.mozilla/firefox` |
On Linux, Firefox is also read under its snap and flatpak roots, and Edge under its flatpak root.
Browsers outside this list are not scanned, and a supported browser installed with a data directory other than the ones above is reported as not present.
The same extension installed in several profiles of one browser is reported once rather than once per profile. Profile names are never collected.
### Unnamed extensions
An entry listed as *Unnamed extension* is one whose identity was recovered but whose metadata was not. The extension id is still exact, because a shortened or partial id would be a different extension.
These are worth opening rather than dismissing. An extension can show no name, publisher, or version and still hold global cookie access and debugger access, and in the extension list that is exactly what an unnamed row with red capability chips is telling you.
### Requirements
Browser extension inventory requires Dev Machine Guard agent **v1.16.0 or later**. Devices on earlier agents keep reporting everything else and contribute nothing to this page.
{% hint style="info" %}
**macOS:** browser state files sit in TCC-protected locations, so the agent needs Full Disk Access to read them. Without it, those browsers cannot be read and their extensions will be missing from this page. See [MDM Deployment](/developer-machines/installation/script/mdm-deployment.md).
{% endhint %}
A scan that runs with no interactive user signed in, such as on an unattended build machine, reports no browser inventory at all rather than reporting every browser as missing. Scanning a service account's home directory would find no browser, and recording that as an answer would erase a real device's inventory.
### What is collected
Only the browsers' own extension state files are read. No browser is launched, and no extension store is contacted.
Never collected:
* Browsing history
* Cookies
* Saved passwords
* Page content
* Profile names
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://docs.stepsecurity.io/developer-machines/browser-extensions.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.