Report Reveals Serious Security Issues in Common Browser Extensions
Modern digital workflows have become increasingly dependent on browser extensions, supporting a variety of tasks ranging from grammar correction, password management, and advanced AI integrations into everyday tasks. Browser extensions have become widely used across both personal and corporate environments, but they remain among the most overlooked vectors of cybersecurity risks in the world.
Although end users continue to enjoy the convenience offered by these tools, many IT and security professionals are unaware of the significant threats that may be posed by the excessive permissions granted to these extensions, which can, in many cases, expose sensitive organizational data and compromise enterprise systems, and which can be a serious concern for an organization.
In its Enterprise Browser Extension Security Report for 2025, a leading authority in browser extension security and management, LayerX Security offers comprehensive insight into the security and management of browser extensions.
In this report, LayerX's extensive customer database of real-world enterprise telemetry is combined with publicly available data from major online marketplaces for browser extensions for the first time to present an analysis of actionable data from actual enterprise telemetry.
A unique perspective is provided in this report by merging these two data streams and analyzing them through the lens of cybersecurity, to provide a comprehensive understanding of how browser extensions are used within enterprise environments, the behaviors of the employees who use them, and the risks associated with these extensions, all of which are often overlooked.
Using this research, we will be able to examine the permissions commonly requested by extensions, identify the high-risk extensions currently in use, and identify critical security blind spots where organizations may be vulnerable to data leaks, unauthorized accesses, or malware infiltration due to critical security blind spots. This report differs from traditional studies, which have focused primarily on public metrics and hypothetical threat models, and instead presents a data-driven assessment of the actual behaviour of enterprises and the usage patterns of extensions.
Using this report, organisations can gain a better understanding of critical security gaps, identify security blind spots, and demonstrate the danger of overly permissive extensions, which can lead to data leakage, unauthorised access, and third-party vulnerabilities. LayerX, a cloud-based threat management platform that combines internal usage data with external ecosystem data, provides an unprecedented insight into a threat landscape that has long been under the radar of many security and IT professionals.
There are several ways in which browser extensions can be used to enhance browser functionality, including the ability to block ads, manage passwords, or customise user interfaces, but they can also be used to make users' browser more vulnerable. While many extensions offer legitimate productivity and usability benefits, not every extension is made with the idea of keeping users safe in mind at all times.
As a result, there are increasing numbers of extensions that have been created with malicious intent.
These extensions seek to steal sensitive data, monitor the activities of users, insert unauthorised advertisements, or, in severe cases, even fully control the browser. The Enterprise Browser Extension Security Report 2025 sheds light on the scope of this neglected risk by highlighting that extensions, by their very nature, often require extensive permissions, which can be easily exploited by attackers.
Taking this into account, the report calls for an entirely new paradigm in the management of browser extensions across organisations' networks.
IT and security teams are encouraged to adopt a proactive, policy-driven approach to oversight of extensions across enterprise endpoints. This begins with a thorough audit of each extension deployed across all enterprise systems.
Creating an extensive inventory of extensions allows organisations to classify them according to their functions, determine their permission levels, assess the credibility of developers, and monitor update patterns to determine the trustworthiness of all extensions.
By understanding this type of information, it is possible to develop a risk-based enforcement strategy that will enable high-risk or suspicious extensions to be flagged, restricted or blocked entirely without impacting the user's productivity.
A key point highlighted in the report is the fact that adaptive security frameworks are imperative because they can respond dynamically to evolving threats in the browser ecosystem. As a result of the increasing number of attacks targeting browser extensions as delivery mechanisms for malware or data exfiltration, these measures are not just advisable, they are essential.
Organisations cannot afford to ignore browser extensions as a secondary concern anymore.
Because malicious or compromised extensions can bypass traditional perimeter defences in a way that is silent, malicious or compromised extensions are a critical threat vector that requires continuous visibility, contextual risk assessment and strategic controls to be effectively managed.
In the past, "man-in-the-browser" attacks were primarily based on malware that would manipulate browser memory by identifying certain HTML patterns and injecting script> tags directly into the content of in-memory web pages.
Despite the undeniable malicious nature of these methods, they were largely restricted by the browser's native security architecture, which in turn kept them from going too far.
As a result, the scripts that were injected were restricted in their ability to access cross-site data, to persist beyond the session, or to execute outside the target page. Because they ran in a sandboxed environment, followed the same-origin policy, and were limited to the duration of the page on which they were inserted.
Despite these limitations, modern threat actors are increasingly taking advantage of malicious browser extensions to circumvent them.
Browser extensions are installed components that are independent of individual web pages, as opposed to traditional web-based malware. In a browser session, they will have access to elevated and persistent resources, allowing them to run continuously in the background, even when there are no tabs open at the time.
The malicious extensions can bypass the same-origin constraints, intercept or modify information from multiple websites with these elevated privileges, access cookies and store them across domains with such elevated privileges, and exert ongoing control over browsing environments without immediate detection. As part of this evolution, a critical change was also made to the JavaScript execution context.
Unlike traditional injections, where the injection executes in the same context as legitimate web application scripts and security tools, leaving behind detectable artefacts like DOM elements, JavaScript variables, and suspicious network requests, extensions are executed in a separate context, often with more privileges.
By separating in-page activity, attackers are less likely to be discovered by conventional security tools that monitor in-page activity, making it easier to conceal their presence and sustain longer dwell times within compromised environments as a result. With their advanced capabilities and stealth, malicious browser extensions mark a significant change in the threat landscape and transform them into powerful weapons for cyber adversaries.
For modern enterprises that are interested in maintaining robust browser-level security, they must understand and mitigate these risks. In addition to showing the scale and complexity of the threat landscape for browser extensions in 2025, the Enterprise Browser Extension Security Report 2025 also provides an actionable framework for mitigating the risks that may arise as a result.
In addition to providing diagnostics, LayerX offers a clear, strategic roadmap to help enterprises move from a fragmented and unmonitored extension environment to one governed, structured, and secure. In addition to containing five core recommendations, this guidance can be used to assist security teams in implementing effective, scalable measures to protect their data.
1. Establish a Comprehensive Extension Inventory
Visibility is a critical part of any meaningful browser extension security strategy, so organizations should establish a comprehensive inventory of all extensions installed across every managed device to establish a comprehensive security strategy. As part of the browser management APIs and endpoint management platforms, IT teams can track the installations and sideloaded components that are both officially installed.
To effectively enforce policy and collect key metadata, such as extension IDs and versions, installation sources, publisher credentials, permissions requested, and installation timestamps, this comprehensive dataset must be created. It serves as the basis for all subsequent analysis and enforcement actions.
2. Classify Extensions by Functionality and Risk Category
As soon as an organisation establishes an inventory of extensions, it should categorise them according to their core functionality. These categories can be categorised according to whether the extensions enhance productivity, integrate AI, improve developer productivity, or encompass media. These categories should also be aligned with predefined risk categories.
Extensions with GenAI or data scraping capabilities, for example, may require elevated access to the application and should be examined more closely; however, extensions whose capabilities are restricted to interface customisation might pose a much lower threat. By categorising the functional components of an application, security teams can prioritise oversight efforts and direct resources accordingly.
3. Deep Dive into Permission Scopes and Access Levels
For security teams to understand the potential impact of each extension, it is vital to analyse the permission sets requested by each extension. Those teams should pay close attention to permissions categorised as high-sensitivity, such as the permissions to read and change all the data on each website users visit, to access browsing history and to manage downloads. Also, less well-known but equally risky scopes are "nativeMessaging" and "cookies."
The use of a permissions-to-impact matrix is a great way for organisations to map technical access to risky scenarios in real-world scenarios, such as session hijacking, data exfiltration, or tampering with web requests.
4. Conduct a Holistic Risk Assessment for Each Extension
As part of a well-rounded risk assessment, contextual factors should be considered as well as technical factors, including the legitimacy of the publisher, the age of the extension, the frequency of updates, the user adoption patterns, and the rating of the extension store.
Using these elements, one can create a weighted risk score for each extension, highlighting high-risk entries that are highly complex with powerful permissions but questionable provenances or widespread deployments. Using automated tools and dynamic dashboards, it may be possible to identify and prioritise emerging threats in real time, allowing for a swift response.
5. Enforce Adaptive, Risk-Based Policies Across the Organisation
It is recommended that organisations, instead of relying on rigid allowlists or denylists, develop flexible, risk-aware policies that are tailored to meet the specific needs of different user groups, business units, or levels of data sensitivity. A low-risk productivity extension could be automatically approved, while a high-risk or unverified extension may require manual approval or be restricted to an isolated developer environment.
Several automated enforcement actions are available to ensure compliance as new extensions are installed, existing extensions are updated, and access is revoked, such as real-time alerts, forced uninstallations, or access revocations. Therefore, as browser extensions continue to become more and more prevalent across enterprise environments, there is a growing recognition that the risks they pose cannot be ignored as secondary.
The report by LayerX is both a call to action and a blueprint for organizations to begin moving from passive tolerance to active governance, and is a call to action. By adopting a data-driven, structured approach to browser extension security, enterprises can reduce the risk they run from vulnerabilities while simultaneously maintaining the productivity gains that extensions were originally designed to deliver.
