Topic starter
10/06/2026 12:12 am
TL;DR: Browser extensions are installed on 99% of enterprise users, nearly 75% request high or critical permissions, and AI extensions are 60% more likely to carry known vulnerabilities, 3x more likely to access cookies, and nearly 6x more likely to expand permissions after installation, according to LayerX Security. That makes browser-based identity exposure a governance problem, not just an endpoint hygiene issue.
Editorial analysis by NHI Mgmt Group, based on content published by LayerX Security: “The AI Tool in Your Browser Is Probably the Biggest Security Risk You’re Not Thinking About”.
By the numbers:
- 99% of enterprise users have at least one browser extension installed.
- 1 in 6 enterprise users already has at least one AI extension installed.
- 64% of users have at least one AI extension that changed its permissions in the past 12 months.
Key questions
Q: How should teams govern approved browser extensions after installation?
A: They should treat approval as the start of governance, not the end.
Q: Why do AI browser extensions create higher data exposure risk than standard extensions?
A: AI browser extensions often request broad access to page content, messages, or input fields so they can provide context aware features.
Q: What breaks when organisations cannot see which browser extensions are installed?
A: Least privilege, recertification, and exception handling all lose their basis if teams cannot tell which extensions exist, who installed them, or what they can do.
Practitioner guidance
- Inventory browser extensions across the enterprise Build a complete list of installed extensions by browser, user, and device, then identify which ones can access cookies, page content, scripts, or tabs.
- Separate AI extensions from ordinary add-ons Create a distinct approval path for AI extensions that weighs known vulnerabilities, cookie access, scripting permissions, and tab management rather than treating them like simple utilities.
- Track permission changes after installation Monitor updates that expand extension permissions and flag any change from the original approval scope, especially when the extension gains access to browser authentication data.
Bottom line: Browser extensions are no longer just productivity tools because they can sit directly inside the browser session where authentication state lives.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 1 day ago by NHI Mgmt Group
11/06/2026 1:53 am
Browser extensions have become a shadow identity layer inside enterprise sessions. They operate with delegated access to the same browser state that users rely on for authentication and application activity. That means traditional IAM visibility ends at the browser boundary, while meaningful privilege continues inside it. Security teams should treat extensions as governed access subjects, not just convenience add-ons.
A few things that frame the scale:
- 72% of organisations have experienced or suspect they have experienced a breach of non-human identities, according to The 2024 ESG Report: Managing Non-Human Identities.
- The average organisation believes more than 1 in 5 of their non-human identities are insufficiently secured.
A question worth separating out:
Q: Should organisations treat browser extensions as part of identity governance?
A: Yes. Extensions operate with delegated access to browser sessions, which makes them a form of shadow identity inside the user environment. If they can reach authentication state or manipulate web content, they belong in the same governance conversation as privileged access and non-human identity controls.
👉 Read our full editorial: AI browser extensions create a hidden identity risk in enterprises
12/06/2026 3:28 am
Browser extensions are now part of the identity perimeter, whether organisations acknowledge it or not. They sit where authentication state, session cookies, and browser content intersect, so their privileges can directly affect access outcomes. That means browser extension governance belongs alongside identity inventory and endpoint control, not as an afterthought in user productivity policy. Practitioners need to treat extension visibility as a core identity control.
A question worth separating out:
Q: How do security teams know if extension governance is actually working?
A: Measure whether unapproved extensions can be installed, whether dormant packages are being reviewed after sudden updates, and whether malicious listings can be blocked before execution. If a dangerous package can still reach a live workspace, governance is failing at the point that matters most.
👉 Read our full editorial: AI browser extensions create a hidden identity risk in enterprises
This post was modified 1 day ago by NHI Mgmt Group