Topic starter
02/08/2026 12:05 pm
TL;DR: Chromium exposes multiple extension installation paths, including user installs, policy-based loads, registry entries, and component extensions, and the browser treats each differently based on ManifestLocation and location rank, according to Island. That distinction matters because extension provenance changes visibility, privilege, and control, making browser governance a security issue rather than a simple user-experience setting.
Editorial analysis by NHI Mgmt Group, based on content published by Island: “Extensions in Chromium and where to find them”.
Key questions
Q: What breaks when browser extensions are reviewed without their installation source?
A: Teams lose the ability to distinguish user-installed code from policy-controlled, registry-loaded, or browser-integrated components.
Q: Why do component extensions create governance risk for security teams?
A: Component extensions sit inside the browser’s own implementation layer, so they may be hidden from the normal extensions page and treated differently from ordinary add-ons.
Q: How should teams use extension precedence in browser control reviews?
A: They should verify which location rank wins when the same extension ID appears in more than one source, especially where policy and user-installed versions could conflict.
Practitioner guidance
- Inventory extension source classes Build an inventory that separates user-installed, policy-installed, registry-loaded, unpacked, and component extensions so reviews reflect actual provenance rather than a flat extension list.
- Review hidden browser components Inspect component extensions alongside normal add-ons, because they may not appear in the standard extensions UI and can carry browser-integrated privileges.
- Validate precedence for duplicate extension IDs Check which ManifestLocation rank is active when the same extension ID appears in more than one location, and confirm that the intended source is the one actually taking effect.
Bottom line: Chromium shows that extension installation source changes how the browser trusts, ranks, and exposes code.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
02/08/2026 1:10 pm
Browser governance now includes extension provenance. Chromium shows that extension location is a control signal, not just metadata. A user-installed add-on, a policy-controlled extension, and a browser component do not belong to the same trust class, even if they look similar in naming or function. For IAM and security teams, that means browser governance should be treated as an entitlement and supply chain problem at the same time.
A question worth separating out:
Q: What should IAM and security teams do when browser extensions are deployed by policy?
A: They should treat policy-deployed extensions as governed entitlements, confirm the business owner and deployment source, and review whether the policy path also changes visibility or override behavior. Policy install is not just distribution, it is a control decision with operational and trust implications.
👉 Read our full editorial: Chromium extension locations show why browser governance matters