An anti-cryptomining browser extension is a browser add-on that blocks or limits scripts used to mine cryptocurrency in the browser. It typically works by filtering known mining domains, script patterns and resource-heavy JavaScript, reducing CPU and battery use while preventing unauthorised use of the browser session.
What an anti-cryptomining browser extension does
An anti-cryptomining browser extension is a browser-side control that reduces the chance that a page can quietly use the user’s tab, CPU and battery to mine cryptocurrency. In practice, it acts as a filter over known mining domains, hostile scripts and suspicious JavaScript behaviour, so the browser session is less available for unauthorised compute abuse.
That makes it closer to a protective browser control than to content blocking in the narrow sense. The goal is not to secure a wallet or block payments, but to stop an in-browser workload from consuming local resources and from running outside the user’s intent.
How browser cryptomining abuse works
Browser cryptomining, often called cryptojacking, usually depends on JavaScript, WebAssembly or injected third-party code that runs after a page loads. The script may be delivered directly, hidden inside advertising or analytics paths, or fetched from a domain that is not obviously related to the site the user visited.
The abuse is attractive because it can be quiet and persistent enough to avoid immediate notice. Even when the mining code does not steal data, it still creates a security and operational problem by turning the browser into a consumption engine for someone else’s workload.
What the extension actually blocks or limits
Most anti-cryptomining extensions rely on reputation lists, domain blocking, script pattern matching and sometimes heuristic detection of resource-heavy behaviour. Some also interfere with mining libraries and workers, which means the control can succeed even if the mining page is hosted on an otherwise legitimate site.
The practical value comes from reducing the browser’s exposure to commodity mining infrastructure and from preventing repeated execution once a mining pattern is recognised. For teams that standardise browser protection, a browser security baseline such as the Browser Extension Security Guide is useful context for understanding extension permissions, allowlisting and risk scoring.
Where cryptomining is part of a broader browser-abuse pattern, extension control should be viewed alongside the wider browser hardening model described in the Browser Security Hardening Guide, because default-deny extension policy and browser policy enforcement often matter more than any single add-on.
Why the control matters to users and organisations
Cryptomining in the browser is a resource abuse problem first, but it can become a larger security issue when the same delivery path is also used for unwanted code execution, extension abuse or session interference. On managed fleets, the risk is not only user annoyance, it is also performance degradation, battery drain, thermal load and reduced confidence in the browser as a trusted work surface.
When organisations rely on browser extensions as a defence layer, they should treat the anti-cryptomining extension as one part of a broader set of browser protections. The Client-Side Security Guide is relevant because the underlying threat model overlaps with third-party script risk, monitoring and client-side visibility.
Risk and Threat Considerations
Browser cryptomining is dangerous because it converts ordinary web activity into unauthorised compute use, and the same delivery channels can also carry more than mining code. If the mining script is bundled with a malicious extension, hijacked content path or drive-by payload, the browser session can become both a performance drain and a foothold for broader abuse.
Failure mechanism: The protection fails when the mining code uses new domains, obfuscated scripts, inline workers or rapidly changing delivery infrastructure that the extension’s block rules do not recognise.
Impact: Users experience CPU saturation, battery loss and degraded browser performance, while defenders may miss the fact that the session is executing unauthorised code until the abuse has persisted long enough to matter.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
CIS Controls v8, NIST SP 800-53 Rev 5, NIST CSF 2.0 and OWASP ASVS set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| CIS Controls v8 | CIS-9 — Email and Web Browser Protections | Controls browser protections that directly reduce malicious extension and web abuse exposure. |
| Recommendation — Enforce browser extension allowlisting and web filtering under CIS-9 to reduce cryptomining and other browser abuse. | ||
| NIST SP 800-53 Rev 5 | SI-3 — Malicious Code Protection | Blocks or limits malicious scripts and code delivered through the browser. |
| CM-7 — Least Functionality | Supports limiting browser capabilities and unnecessary extension execution paths. | |
| Recommendation — Apply SI-3 to detect and block malicious browser-delivered code associated with cryptomining. Use CM-7 to restrict browser features and extensions that enable unauthorized mining activity. | ||
| NIST CSF 2.0 | PR.PS-03 — Platform security is managed | Browser extensions are part of platform hardening and secure operation. |
| Recommendation — Manage browser platforms so extension controls and policy enforcement reduce cryptomining exposure. | ||
| OWASP ASVS | V13 — Configuration | Browser extension policy and client-side configuration are core to reducing abuse paths. |
| Recommendation — Harden browser configuration and extension policy to limit client-side abuse opportunities. | ||
Practitioner Guidance
Why practitioners should care: An anti-cryptomining extension is most effective when it is part of a managed browser policy, not an optional user install. The control works best when organisations pair it with extension allowlisting, browser inventory and monitoring for suspicious resource consumption.
What to watch for: Repeated complaints about fan noise, battery drain or browser sluggishness can be early signals of mining abuse, but so can unexplained CPU spikes on a small set of pages or extensions. If those patterns appear, the browser extension should be reviewed alongside the browser’s installed add-ons and policy enforcement.
Practitioner takeaway: Use the extension as a containment layer, but do not treat it as a complete browser-security strategy, because mining abuse is often only one symptom of a wider extension or client-side trust problem.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on November 3, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org