A browser extension that performs harmful or unauthorized actions after being installed or updated. It may begin as a legitimate tool and later change behaviour through a malicious update, takeover, or hidden code. Because extensions run inside the browser, they can expose credentials, sessions, and sensitive web activity.
Expanded Definition
A malicious browser extension is not just a risky add-on; it is code that executes with browser-level trust and can observe, alter, or exfiltrate activity in real time. In NHI security, the key issue is that extensions often inherit access to sessions, cookies, page content, and any secrets exposed in web applications, which makes them a practical path to credential theft and session hijacking.
Definitions vary across vendors on whether an extension is considered malicious only when it was designed to harm, or also when a legitimate extension is later compromised through takeover or a malicious update. For governance purposes, NHI Management Group treats both outcomes as malicious if the resulting behaviour is unauthorized. That distinction matters because an extension can appear trustworthy at install time and still become a high-risk execution channel later.
This risk maps closely to browser and application control expectations in NIST SP 800-53 Rev 5 Security and Privacy Controls, especially where organisations need to constrain unauthorized code execution and protect authenticated sessions. The most common misapplication is treating extensions as harmless productivity tools, which occurs when browser permissions are approved without reviewing update paths, publisher trust, and data access scope.
Examples and Use Cases
Implementing extension governance rigorously often introduces user friction and operational review overhead, requiring organisations to weigh productivity gains against the cost of tighter approval and monitoring.
- A developer installs a clipboard or password helper that silently reads web forms and forwards credentials to an attacker-controlled endpoint.
- A once-legitimate extension is sold, taken over, or updated with hidden tracking logic that harvests session cookies after installation.
- A browser extension injects code into cloud consoles or admin portals, capturing API keys and temporary tokens displayed on screen.
- Security teams discover hard-coded secrets inside a browser add-on supply chain, similar to the issues described in Hard-Coded Secrets in VSCode Extensions, where trusted tooling becomes a secret-exposure path.
- Browser allowlisting is paired with endpoint policy so only reviewed extensions can run in environments that handle privileged NHI workflows.
These scenarios are easier to understand when aligned to established access-control thinking in NIST SP 800-53 Rev 5 Security and Privacy Controls, especially monitoring, least privilege, and configuration governance.
Why It Matters in NHI Security
Malicious browser extensions are particularly dangerous because they operate inside the same trust boundary as the user’s authenticated browser session. That makes them an efficient way to intercept secrets, manipulate approvals, and bypass controls that would otherwise protect service accounts, admin portals, and SaaS consoles. In environments where humans manage NHIs through web interfaces, an extension can become an indirect compromise path to API keys, tokens, and privilege escalation.
The NHI Mgmt Group data shows why this matters: 79% of organisations have experienced secrets leaks, and 77% of those incidents caused tangible damage, while 96% store secrets outside secrets managers in vulnerable locations including code, config files, and CI/CD tools. When browser extensions are allowed to process those same workflows, exposure expands from stored secrets to active session material and live administrative actions.
Practitioners should treat extension inventory, publisher trust, update control, and browser telemetry as part of the NHI attack surface. This also fits the broader control intent behind NIST SP 800-53 Rev 5 Security and Privacy Controls, which expects organisations to manage system components and detect unauthorized behaviour. Organisations typically encounter the full operational impact only after a session hijack, token theft, or admin-console compromise, at which point the extension problem becomes impossible to ignore.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and OWASP Agentic AI Top 10 address the attack and risk surface, while NIST CSF 2.0 and NIST SP 800-63 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-02 | Malicious extensions often steal or expose secrets and sessions, matching secret-management risk. |
| OWASP Agentic AI Top 10 | Extensions can alter tool-mediated actions and data flow in browser-based agent workflows. | |
| NIST CSF 2.0 | PR.AA-01 | Identity and access assurance depends on protecting authenticated browser sessions from tampering. |
| NIST SP 800-63 | Browser-session compromise can undermine digital identity assertions and authenticator trust. |
Restrict secret exposure in browser workflows and review extension access before tokens can be captured.
Related resources from NHI Mgmt Group
- What breaks when a browser extension publisher account is compromised and malicious releases are mixed with clean releases?
- How should organizations manage browser extension risks?
- When is it appropriate to remove a browser extension?
- What is the difference between a browser extension risk and a normal SaaS integration risk?
Deepen Your Knowledge
Reviewed and updated by the NHIMG editorial team on August 27, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org
