[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fq8dVU-bPl0Kyy21v5YWXTgYUODrxZZfZ9rDCG8xi4Fo":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":17,"status":23,"created_at":24,"published_at":25,"article":26,"tags":30,"podcasts":43,"controls":44},"8d086404-0410-4591-b8a1-82651e2b04c7","browser-extensions-are-a-silent-supply-chain-threat","3b3ebf51-63a1-4625-bc19-eea8cb01fca5","Browser Extensions Are a Silent Supply-Chain Threat","Browser extensions pose a serious supply-chain risk because they silently auto-update, can change ownership, and routinely hold broad permissions to access session data, credentials, and browsing activity. Attackers have exploited this by compromising developer accounts to push malicious updates — as seen with The Great Suspender and campaigns targeting Facebook advertising accounts — turning trusted tools into credential-stealing malware. Organizations rarely inventory or govern browser extensions with the same rigor applied to software packages, leaving a wide-open attack surface. This matters because a single compromised extension can expose authenticated sessions and sensitive data across an entire workforce.","**Immediate actions:**\n- Audit all installed browser extensions across the organization and remove any that are unused, unrecognized, or no longer maintained by a trusted developer.\n- Review and restrict extension permissions so that no extension holds broader access (e.g., \"read and change all your data on all websites\") than its stated function requires.\n\n**Long-term improvements:**\n- Establish and enforce an approved-extensions allowlist via browser policy (e.g., Chrome Enterprise or Group Policy) so only vetted extensions can be installed.\n- Monitor extension ownership and update history as part of a formal software supply-chain review process, treating extensions the same as third-party libraries.\n- Use browser profiles or dedicated browsers that isolate high-risk sessions (e.g., financial, admin) from general browsing where extensions may be present.\n\n**Detection measures:**\n- Deploy endpoint or browser telemetry that alerts on new extension installations or permission escalations in the enterprise environment.\n- Subscribe to threat intelligence feeds that track known-malicious or newly-compromised browser extensions to enable rapid response when a trusted extension is taken over.",[12,13,14,15,16],"CIS Control 2: Inventory and Control of Software Assets (v8)","NIS2 Article 21(2)(d)","NIST SP 800-53 SA-12: Supply Chain Protection","NIST CSF 2.0 ID.AM-2: Software, services, and systems inventories are maintained","MITRE ATT&CK T1195.001: Compromise Software Dependencies and Development Tools",{"NIS2 Article 21(2)(d)":18,"NIST SP 800-53 SA-12: Supply Chain Protection":19,"CIS Control 2: Inventory and Control of Software Assets (v8)":20,"MITRE ATT&CK T1195.001: Compromise Software Dependencies and Development Tools":21,"NIST CSF 2.0 ID.AM-2: Software, services, and systems inventories are maintained":22},"NIS2 Article 21(2)(d) mandates supply-chain security measures including policies on the security of relationships with direct suppliers, directly applicable to managing third-party browser extension risk.","SA-12 requires organizations to implement safeguards to protect against supply-chain threats, which covers vetting and continuously monitoring third-party software components like browser extensions.","CIS Control 2 requires maintaining an inventory of all authorized software, which would have prompted organizations to track, approve, and periodically re-evaluate browser extensions as software assets.","This technique describes adversaries compromising third-party software supply chains — exactly how attackers hijacked developer accounts to push malicious extension updates.","This category requires that software inventories be maintained, which would have led organizations to discover, assess, and govern installed browser extensions before a compromise occurred.","published","2026-11-11T20:20:24.040554+00:00","2026-11-11T20:20:24.025+00:00",{"id":7,"url":27,"slug":28,"title":29},"https:\u002F\u002Fwww.cyberkendra.com\u002F2026\u002F11\u002Fhow-to-audit-browser-extensions-for-supply-chain-risk.html","how-to-audit-browser-extensions-for-supply-chain-risk-bd5d7d","How to Audit Browser Extensions for Supply-Chain Risk",[31,37],{"id":32,"name":33,"slug":34,"description":35,"color":36},"859cf0ad-a7e9-42bb-a75d-bac6511fa5d5","Configuration Management","configuration-management","Misconfigs, default credentials, exposed services","#eab308",{"id":38,"name":39,"slug":40,"description":41,"color":42},"f0c2a0af-58aa-4128-87c9-6acd30f2dc48","Supply Chain","supply-chain","Third-party risk, compromised dependencies","#8b5cf6",[],[45,49,53],{"slug":46,"name":47,"problem":48},"endpoint-management","Device management (MDM and UEM)","Every company laptop and phone is known, encrypted, locked down and up to date.",{"slug":50,"name":51,"problem":52},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them.",{"slug":54,"name":55,"problem":56},"software-supply-chain","Software supply chain security","Malicious and vulnerable open-source packages are caught before they ship."]