CG3 - Browser Defender: Extension Governance

The Extension Governance page lists third-party extensions installed in corporate browsers, assigns each a risk level, and allows you to block them across your entire company. An extension appears in the list as soon as it is detected on a device, or you can block it in advance by searching for it via its store URL, even if no one has installed it yet. To access it, open Browser Defender from the side menu and select Extension Governance. Requires Browser Defender to be active for your company and the Platform Administrator role.

This page allows you to:

• Get an overview of third-party extensions installed in your company, from official stores or manually loaded.
• Assess the risk of a single extension — risk level, required permissions, and adoption — before deciding whether to use it.
• Block a risky or unauthorized extension across your entire company, with the extension disabled on devices where it is already installed and new installations prevented.
• Block an extension in advance before it is installed, by searching for it via its store URL.

This page is not designed for: analyzing visited sites or downloads (Browsing Alerts and Dangerous Downloads pages), checking corporate password reuse (Password Reuse page), or distributing the extension or configuring its browsing policies (Setup and Users sections).

The page opens on the Installed tab. Switch to Blocked for already blocked extensions, or use Search to find one by name.

Each row shows Name, the number of Users, and a Warnings badge — colored based on the most severe risk level detected; it appears only after the extension has been analyzed. The severity levels are described below in the "Risk levels (Warnings)" section.

Clicking on an extension opens the detail panel: icon, name, browser, adoption (users and store rating), categories, description, the Warnings list, the Permissions list, and the Installations table.

Risk levels (Warnings)

Each signal has a severity level — High, Medium, or Low — and the badge reflects the most severe one present:

Permissions panel

The Permissions panel classifies the extension as Intrusive, Moderately intrusive, or Minimally intrusive, and lists in plain language the required permissions (e.g., "read and modify all data on all websites").

Installations table

For each user with the extension installed: Email, Version (with a warning if a newer version is available), Install mode, Status (Enabled/Disabled), Browser, and Last detected.

From the detail panel, these actions are available:

Upon confirmation, the blocked extension moves to the Blocked tab.

NOTE: blocking updates the panel and tab immediately, but on a device where the extension is already installed, it takes effect only at the next backend check — not necessarily on all devices instantly.

If an extension was already installed in the browser when it gets blocked, it does not disappear on its own: at the next device check with the backend, it appears disabled in the browser, as described above.

If instead an employee tries to install a blocked extension, the browser shows this sequence:

1. A warning page with an Uninstall button.
2. The browser's native dialog box, asking for confirmation of uninstallation.
3. A confirmation page of successful removal.

Some elements that affect what is shown on this page are configured elsewhere:

• Extension distribution — depends on Setup and the extension itself; an extension appears here only after being detected from a distribution.
• Hide an extension — single or for prolonged inactivity, is done from the Browser Users page, not from here.