Browser Extensions Are a Security Risk Your Business Is Probably Ignoring
It is Monday morning and someone on your team installs a browser extension that promises to save them time - a PDF converter, a grammar checker, something that clips web pages for notes. It takes thirty seconds and they never think about it again. Multiply that across a team of ten people over two years and you have a browser full of small, mostly forgotten software tools, each with permissions to read and modify what happens in that browser.
Most browser extensions are harmless. But some are not, and the problem is they look identical. An extension that quietly reads your browsing activity, captures what you type, or redirects you to fake login pages does not announce itself. It sits in the toolbar next to the legitimate ones and gets on with it. For a business handling client records, financial data, or anything protected under the NZ Privacy Act 2020, that is a real exposure - not a theoretical one. Understanding how hackers get into business accounts helps put this kind of risk in context.
The risks fall into a few categories. Extensions can request sweeping permissions that most people accept without reading. They can be built with malicious intent from the start - some well-designed extensions have been bought by third parties after becoming popular, then updated to include data-harvesting code. And extensions that are simply abandoned by their developers stop receiving security updates, leaving known vulnerabilities sitting open in your browser indefinitely. This is one of the reasons certain types of malware are catching businesses off guard more frequently than most owners realise.
When this is managed properly, the working day looks different. Staff install only what they genuinely need, from browser marketplaces tied to reputable developers like Google or Microsoft. Permissions get reviewed before anything is added - if a PDF tool is asking to read your browsing history, that is a red flag worth acting on. Extensions are audited periodically and anything unused or unmaintained gets removed. Endpoint security software adds a layer of detection for known malicious extensions that slip through. None of this is complex, but it does need someone to own it consistently, which rarely happens when IT is being managed informally. Pairing this with strong password and MFA practices closes off many of the same attack paths.
The practical step here is not to go and audit every extension yourself - you have a practice to run. It is to make sure whoever manages your IT is including browser hygiene as part of their regular work, not treating it as an afterthought. A managed IT arrangement that covers endpoint security should include policies around what staff can install and regular checks to make sure those policies are holding. If you are not sure what is on your team's browsers right now, that is worth finding out. CERT NZ at cert.govt.nz also has practical guidance on browser security for businesses.
ITstuffed works with professional services businesses across Canterbury on exactly this kind of layered cyber security - the unglamorous, ongoing work that keeps a business from becoming an easy target. If you want a quick read on where you stand, an IT Fit Check takes 15 minutes and gives you a clear picture. Book one at /booking.