Topic starter
25/10/2026 11:04 am
TL;DR: Trusted Chrome extensions can turn into enterprise blind spots after ownership transfers, because publisher identity can change while the extension ID, allowlist status, and user trust remain intact, according to Pluto Security research. The control gap is continuous re-vetting, not one-time approval.
Editorial analysis by NHI Mgmt Group, based on content published by Pluto Security: “Chrome Extension Supply Chain Attacks: How Ownership Transfers Enable Silent Permission Creep”.
Key questions
Q: What breaks when a browser extension changes behavior after approval?
A: The trust model breaks because approval was based on an earlier version of the code, not on the extension’s current runtime behavior.
Q: Why do browser extensions and SaaS sessions create identity risk?
A: Browser extensions and SaaS sessions create identity risk because they operate inside the user’s authenticated context.
Q: How can security teams detect browser extension privilege drift?
A: Teams should baseline extension permissions at approval time and then compare those permissions after each update.
Practitioner guidance
- Revet allowlisted extensions after ownership changes Require a fresh approval whenever a browser extension changes publisher identity, support contacts, or ownership.
- Track manifest and permission deltas Compare each new version against the last approved manifest, with special attention to new host permissions, tabs, cookies, webRequest, nativeMessaging, and CSP relaxation.
- Enable extension inventory and reporting Use browser management telemetry to inventory installed extensions, versions, and permission scopes across managed devices so changes are visible before users notice them.
Bottom line: Browser extensions can become a supply chain issue after ownership transfer because the approved artifact may no longer be controlled by the same party.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →