Browser Extensions

The Browser Extensions page gives you an organization-wide view of every extension installed in your developers' browsers, what each one is currently permitted to do, and which machines it is running on.

Extensions run inside the browser your developers sign into source control, cloud consoles, and internal applications with. An extension granted access to every site can read what is on the page. Reading the cookies that authenticate a session, or observing the requests the browser makes, requires additional API permissions on top of that host access. They are installed by individual developers rather than by IT, they update themselves silently, and they change ownership without notice, so an extension that was safe when it was installed is not necessarily safe today.

A summary at the top of the page shows how many unique extensions were detected across active devices, for example Total 21 unique extensions across 11512 active devices.

Where to start

Three questions this page answers quickly:

• Which extensions can see everything? Select the Global website access, Global script injection, Global cookie access, or Debugger access capability chips. These are the extensions where one bad update reaches everything the developer does in that browser.
• Which extensions did not come from a marketplace? Set the store filter to Self-hosted, No store, or Unknown. Self-hosted confirms an update source outside the known stores. No store and Unknown mean provenance could not be established, which makes them useful investigation filters rather than proof that marketplace review was skipped.
• Who is running a specific extension? Search by name or extension id, open the result, and read the device list. When an extension is reported as compromised, this is the fastest path from an advisory to the affected machines.

Filters

Browser chips scope the list to Chrome, Edge, or Firefox, each showing the number of unique extensions detected for that browser.

Capability chips scope the list to extensions holding a given capability, each with a count. Selecting more than one chip shows extensions holding any of the selected capabilities. Capability filters are then combined with the browser, engine, store, and search filters.

A capability listed for an extension across the fleet means the authority was confirmed on at least one device. An absent capability means it was not confirmed, which is not the same as the extension being safe. See Capabilities.

The page also supports:

• Search by ext name or ID: free-text search across extension names and extension ids
• All engines: filter by browser engine, chromium or gecko
• All stores: filter by where the extension came from
• Export CSV: export the current filtered view

The extension list

Column	What it shows
Extension	The extension name, with its extension id beneath. See Unnamed extensions for entries with no recoverable name.
Browser	The browser it is installed in. The same extension installed in two browsers is listed once per browser, because the permissions each browser honours are its own.
Store	Where the extension came from. See Store.
Capabilities	The capabilities the browser is currently honouring. Where an extension holds more than the row can show, the remainder appear as a +n chip.
Version	The installed version, or - where the browser recorded none.
Devices	How many devices in your fleet have it installed.
Last seen (GMT)	When a device last reported it.

Capabilities

Capabilities describe what an extension can do with the permissions the browser is honouring for it right now. They are not what the extension asked for in its manifest, and permissions a developer has granted and later withheld are not counted.

Capability	What it means
Global website access	Granted host permissions cover effectively every website. This is host authority only and implies nothing else.
Script injection	Can run its own JavaScript inside web pages, but only on the specific hosts the browser has granted it.
Global script injection	Can inject its own JavaScript into effectively every website, unrestricted by host.
Global request observation	Can see the requests the browser makes on any site, including URLs and headers. Body access is not confirmed.
Cookie access	Can read cookies, including session tokens, but only on the specific hosts the browser has granted it.
Global cookie access	Can read cookies, including session and login tokens, on effectively every website, unrestricted by host.
Browsing history	Can read and modify the full browsing history recorded on the device, across every site visited.
Debugger access	Can attach the browser debugger to open tabs and inspect or control browser activity.
Clipboard read	Can read clipboard contents from an extension context, which may contain passwords and 2FA codes.
Extension management	Can inspect and, where allowed, enable, disable, or remove the other extensions in the browser.

Each capability is derived from the evidence that capability requires. Some come from host permissions, some from browser API permissions, and some require both. Global script injection, for example, requires both a scripting permission and host access covering every site. An extension with the scripting permission but access to two named domains holds Script injection, not the global form. The detail panel prints the meaning of each capability beside its chip.

Global script injection, Global cookie access, and Debugger access are shown in red. Global website access and Global request observation are shown in amber. Red first, then amber, is the sensible order for a review.

No confirmed capabilities means the collected data does not show the extension holding any of the tracked capabilities. It is not a safety verdict, and it also covers devices that have not reported since capability collection shipped in agent v1.16.0.

Store

The Store column separates extensions that came from a vendor marketplace from those that did not.

Value	Meaning
Chrome Web Store, Edge Add-ons, Mozilla Add-ons	Attributed to that vendor's marketplace. Chromium extensions are attributed using known update URLs. A Firefox signature does not establish Mozilla Add-ons provenance, since a signed extension may also be self-hosted, so a Firefox extension's store origin may appear as Unknown.
Self-hosted	Updates from a server the publisher runs rather than from a marketplace.
No store	No vendor-store attribution. The collector also reports this for an unsigned Firefox add-on, which does not by itself prove the extension has no update source.
Unknown	The browser's record does not attribute it to any source.

Anything other than a vendor marketplace is worth a look. Self-hosted confirms an update source outside the vendor's control. No store and Unknown mean provenance could not be established from the collected data, so treat them as candidates for investigation rather than as confirmed unreviewed extensions.

Sideloaded extensions, which a developer loads directly after turning on the browser's developer mode instead of installing from a store, are detected and reported like any other. Store provenance and installation method are recorded separately, so filtering the store to Self-hosted, No store, or Unknown surfaces extensions with non-marketplace or unestablished provenance rather than listing every sideloaded install. A sideloaded extension can still carry a recognised marketplace update URL.

Extension details

Select any extension to open its detail panel.

At the top: Devices, Versions, and Store, the last linking out to the marketplace listing where the extension has one.

Extension information shows:

• Engine: chromium or gecko
• Last seen at: when a device last reported this extension
• Capabilities: each capability held, with its meaning beside it, or a statement that none were confirmed
• Host permissions: the collected URL patterns the extension holds access to, such as https://extensions.gnome.org/*. Long permission lists may be truncated.
• API permissions: the browser APIs the extension holds, such as scripting, userScripts, declarativeNetRequest, nativeMessaging, tabs, or storage

Host permissions and API permissions are the evidence behind the capability chips. Reading them together tells you not just that an extension can inject scripts everywhere, but which APIs it would use to do it.

Devices

At the bottom, Devices lists where the extension is installed:

• By version groups devices under each installed version. This is the faster view when an advisory names a specific bad version, or when you need the machines still on an older release.
• All devices lists affected devices individually with each one's version, flags, and when the install was last collected. The list shows the first 500 affected devices.

Flags

Flags qualify an individual install rather than the extension as a whole, and appear in the Flags column beside each device in the All devices view.

Flag	What it means
All sites	The install holds host access covering effectively every website on that device. This is the device-level view of the same grant that produces the global capabilities above.
Developer loaded	The install was loaded directly through the browser's developer mode rather than installed from a store. This is the reliable signal for a sideloaded install, and it is recorded per device.
Preinstalled	The browser shipped the extension itself rather than a developer choosing it. Google Docs Offline in Chrome is the common example. It is still a real extension with real permissions, so it is reported, but it is not evidence of anything a developer did.

For Chromium installations, browser-cached marketplace state may identify an extension as Delisted or Flagged. Dev Machine Guard does not contact the marketplace during scanning, so those values may lag a store change until the browser refreshes its own metadata. They are returned by the device-specific inventory endpoint rather than in the device rows of the fleet extension detail, so they are not shown in the table above.

Supported browsers

Chrome, Edge, and Firefox are covered, on macOS, Windows, and Linux. Extensions are read from each browser's own state files under the signed-in developer's home directory.

Browser	Engine	macOS	Windows	Linux
Google Chrome	Chromium	~/Library/Application Support/Google/Chrome	%LOCALAPPDATA%\Google\Chrome\User Data	~/.config/google-chrome
Microsoft Edge	Chromium	~/Library/Application Support/Microsoft Edge	%LOCALAPPDATA%\Microsoft\Edge\User Data	~/.config/microsoft-edge
Mozilla Firefox	Gecko	~/Library/Application Support/Firefox	%APPDATA%\Mozilla\Firefox	~/.mozilla/firefox

On Linux, Firefox is also read under its snap and flatpak roots, and Edge under its flatpak root.

Browsers outside this list are not scanned, and a supported browser installed with a data directory other than the ones above is reported as not present.

The same extension installed in several profiles of one browser is reported once rather than once per profile. Profile names are never collected.

Unnamed extensions

An entry listed as Unnamed extension is one whose identity was recovered but whose metadata was not. The extension id is still exact, because a shortened or partial id would be a different extension.

These are worth opening rather than dismissing. An extension can show no name, publisher, or version and still hold global cookie access and debugger access, and in the extension list that is exactly what an unnamed row with red capability chips is telling you.

Requirements

Browser extension inventory requires Dev Machine Guard agent v1.16.0 or later. Devices on earlier agents keep reporting everything else and contribute nothing to this page.

macOS: browser state files sit in TCC-protected locations, so the agent needs Full Disk Access to read them. Without it, those browsers cannot be read and their extensions will be missing from this page. See MDM Deployment.

A scan that runs with no interactive user signed in, such as on an unattended build machine, reports no browser inventory at all rather than reporting every browser as missing. Scanning a service account's home directory would find no browser, and recording that as an answer would erase a real device's inventory.

What is collected

Only the browsers' own extension state files are read. No browser is launched, and no extension store is contacted.

Never collected:

• Browsing history
• Cookies
• Saved passwords
• Page content
• Profile names