Can you name every browser extension running in your fleet right now - and say what each one can read?

Almost no organization can. An extension is third-party code that any employee installs in two clicks, and it runs inside the authenticated session - after SSO, after MFA - with permission to read page content, cookies, and form input across every site your people sign in to. That code then updates silently, and publishers sell their listings to new owners. An extension that was safe at install can ship a credential-harvesting payload at version 4.2. EDR does not parse an extension manifest, CASB never sees it, and your browser admin console reports what is installed without ever saying whether it is safe.

Extension Auditor closes that gap. It is browser extension security and governance for security and IT teams:

discovery, risk analysis, policy enforcement, continuous monitoring, and audit evidence in one platform - with no proxy, no traffic interception, and no new endpoint agent.

Discover - every extension, on every managed browser

• Companion browser agent for Chrome, Edge, and Brave, enrolled per browser profile
• Or agentless sync from the consoles you already run: Microsoft Entra and Defender Vulnerability Management, or Google Workspace (CBCM) - on Business and Enterprise plans
• Run either or both - per-profile inventory with heartbeat freshness, covering browsers your MDM never sees

Assess - a risk score your engineers can argue with

• Scoring across permissions, manifest, publisher identity, and code patterns
• Dangerous permission combinations weighted up; four tiers, LOW through CRITICAL
• PermHash clustering fingerprints an extension's permission signature, so malicious clones published under different listings resolve to the same risk
• The methodology is published, not black-boxed - a black-box score gets ignored, an explainable one gets acted on

Enforce - block the dangerous ones, without a help desk flood

• Policy rules resolve to allow, warn, or block, per extension
• Three rollout modes: report only, warn, then enforce
• Start silent, watch verdicts accumulate, and tighten when the picture is clear

Monitor - catch the moment safe turns unsafe

• 11 event types: permission, host-permission, manifest, CSP, version, ownership, account-type, visibility, review, rating, and security-verdict changes
• Publisher email-change history and store-removal tracking
• Alerts to Microsoft Teams, Slack, email, in-app, or any custom webhook

Prove - audit evidence as a byproduct

• SOC 2 and ISO 27001 control mapping on Business and Enterprise, so extension governance stops being the control you scramble to document the week before fieldwork
• Audit logging and full REST API on every plan, for your SIEM and SOAR pipelines

Built for Microsoft environments

• Microsoft Edge covered by the companion agent
• Agentless extension inventory through Microsoft Entra and Defender Vulnerability Management (Business and Enterprise)
• Sign in with Microsoft Entra ID; SAML SSO on every plan, including Free
• Native Microsoft Teams alerting
• Buy here to draw down an existing Microsoft commitment and shorten procurement

Who it is for

Security and IT teams running a managed Chrome, Edge, or Brave fleet — typically 200 to 2,000 employees, and often preparing for SOC 2 Type II or ISO 27001. Extension Auditor layers on top of Chrome Browser Cloud Management and Edge management via Entra: it reads from your admin console, it does not replace it.

How it is priced

Per managed browser, billed annually, with a free trial on every paid plan. One enrolled browser profile is one managed browser; admin logins are never billed, and extensions discovered on a managed browser are never metered — the bill does not punish thorough discovery. Fleet size sets the tier automatically: Team at $9 per browser per month (5–200 browsers), Business at $12 (201–1,000), Enterprise at $18 (1,001+).

Start your free trial and see your own fleet's extensions first.