Topic starter
16/01/2026 3:15 pm
TL;DR: Malicious browser extensions can exfiltrate cookies, session tokens, and other sensitive data while bypassing store review, with one 2024 campaign affecting at least 35 Chrome extensions and about 2.6 million users, according to Obsidian Security. The governance gap is not just detection, but controlling permission sprawl and downstream identity exposure.
Editorial analysis by NHI Mgmt Group, based on content published by Obsidian Security: “The Hunt for Malicious Browser Extensions: What Security Teams Need to Know”.
By the numbers:
- A December 2024 campaign targeted at least 35 Chrome extensions.
Key questions
Q: What breaks when browser extensions are not governed in enterprise environments?
A: The main failure is that the browser becomes an unmanaged privilege zone.
Q: Why do browser extensions and SaaS sessions create identity risk?
A: Browser extensions and SaaS sessions create identity risk because they operate inside the user’s authenticated context.
Q: What are the signs that browser extension controls are failing?
A: Common warning signs include users installing extensions outside policy, extensions running with excessive permissions, unexpected outbound connections to third parties, and risky activity that is not being alerted on.
Practitioner guidance
- Build a browser extension inventory Catalogue every extension in managed browsers, then sort by permission scope, user count, and whether the extension can touch authenticated SaaS sessions.
- Review extension publisher trust and update paths Check whether extensions are maintained by the original publisher, whether update channels are controlled, and whether account takeover would let malicious code replace benign code.
- Reduce browser permission sprawl Remove extensions that request broad read and write access where the business function does not justify it, especially on browsers used for SaaS administration.
Bottom line: Browser extensions can turn ordinary SaaS sessions into identity exposure points when they inherit cookies, tokens, and page access.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 4 days ago by NHI Mgmt Group
08/10/2026 5:06 pm
Browser extensions have become a governance surface, not just a productivity choice. They sit inside the user session and can inherit access to the same cookies, tokens, and SaaS workflows that identity teams work to protect. That means extension risk belongs in NHI governance and SaaS access policy, not only endpoint management. Practitioners need to treat extension approval as a lifecycle decision with downstream identity consequences.
A few things that frame the scale:
- Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
- 96% of security operations teams report critical blind spots, most commonly in cloud infrastructure (74%) and identity and access behaviour (67%).
A question worth separating out:
Q: Should security teams treat browser extensions like third-party access?
A: Yes. A browser extension can function like delegated third-party code because it inherits access to the user session and can change behaviour after initial approval. That makes lifecycle control important. Teams should evaluate who publishes the extension, what permissions it requests, and how quickly it can be removed if the trust relationship changes.
👉 Read our full editorial: Browser extension risk exposes a widening NHI governance gap