Browser Security: The App Your Whole Business Runs In

A staff member installed a PDF converter extension on a Tuesday in March. It worked, nobody thought about it again, and it sat there for eight months.

Then the extension changed hands. The new owner pushed an update, and the permission the original had asked for was now being used to copy the contents of every page the browser opened.

That included the payroll screen, and it included the bank portal a director had left open in a second tab.

The business found out eleven weeks later, when a supplier rang to ask why its bank account had changed on an invoice nobody at the firm had edited.

The example is illustrative. Extensions change hands often, and the new owner inherits everything the old one was allowed to do.

Put a number on it. Call this an illustrative 42-person Christchurch professional services firm, where everyone works in Microsoft 365 through a browser and no one has ever audited what is installed in it.

One hijacked session in the past two years cost it $14,000 that insurance would not cover. A hijacked session is an attacker using a copy of the login your staff member already completed. Averaged out, about $7,000 a year.

Fourteen leavers a year each burn about ninety minutes of extra IT and admin time, because nobody can say which extensions and browser-stored passwords they had. At $95 an hour, another $2,000.

Staff keeping the same credentials in the browser and in the vault generate about nine password resets a month, at twenty-five minutes of combined staff and helpdesk time each. Call it $3,800 a year.

That is $12,800 a year, and none of it is itemised anywhere, because no invoice ever arrives for a browser.

Browsers get treated as furniture, because they come with the laptop and update themselves and nobody ever signs a contract for one. Meanwhile the browser holds live access to your payroll and your banking.

What Is Browser Security?

Browser security means managing the browser the way you already manage the laptop it runs on. You decide which extensions are allowed, where staff keep passwords, whether work and personal accounts share a window, and how fast a session can be shut off.

Most businesses manage the device and the mail platform, and leave the browser sitting between the two with no policy on it at all.

Nearly all your work now happens inside it. A firm running Microsoft 365, Xero, a CRM and a payroll portal opens all four in the same application.

You have already paid for the controls: Chrome and Edge both ship enterprise policy at no extra licence cost, and setting the first version takes an afternoon.

What sits inside a browser profile?

A browser profile holds four things, and you can see almost none of them until the browser is enrolled in a management console.

• Extensions, which run with the permissions they were granted at install and keep them through every later update.
• Saved passwords, held in the browser’s own store, which sits outside any password vault the business pays for.
• Session cookies, which prove to a website that this browser has already signed in.
• Sync, which copies whatever the profile holds to whichever account it happens to be signed in to.

Ask your IT provider what is inside the browsers on your machines. Most cannot answer without enrolling them first, which is a one-off change on managed devices.

How is the browser different from the device it runs on?

The device is managed by an agent and the browser is managed by policy, and the two do not overlap. Our guide to protecting the device itself covers the operating system and the processes running on the machine.

An extension does not have to be malware on disk to do damage. It runs inside a trusted application, using a permission a person approved.

You need both layers. Endpoint tooling will not tell you that a marketing extension holds permission to read the payroll page, and browser policy will not stop a virus.

Can Browser Extensions Steal Data?

Yes. A malicious extension can read everything on any page covered by the host permissions it was granted, which for many extensions means every site.

Google’s extension documentation sets out what a host permission enables: injecting a content script into the page, reading tab titles and URLs, reading cookies through the cookies API, and monitoring or changing network requests.

A content script is code the extension inserts into the page in front of you. Once it is there, the extension sees what you see, including anything already on screen.

That covers the client file open in the next tab and the bank balance on screen behind it.

You can see what an extension is asking for before anyone approves it. The permissions are printed on the store page, in plain English, next to the install button.

Which extension permissions should stop an install?

Stop at read and change all your data on all websites. It is the broadest grant Chrome offers, and plenty of extensions ask for it to do a job that needs one domain.

Access to browsing history, and permission to manage other extensions, both give an extension reach past the page it was installed for.

Browser extension security starts at the install, because a permission granted once is never re-asked at the next update.

Chrome’s extension settings policy can also fence an extension off from named sites, so a tool that reformats one supplier portal never reaches the payroll screen.

How does a safe extension turn dangerous later?

A safe extension turns dangerous when it changes owner or updates itself. Extensions update in the background, and the permissions granted to version one carry across to version nine with no second prompt.

Extension marketplaces are also a resale market. A developer with a hundred thousand installs holds an asset, and a buyer inherits the permissions along with the users.

At review time, ask who publishes it and what it would cost you if they sold up next month.

Where staff fit their own tools without asking, the habit predates the browser. Our guide to the tools staff bring in themselves covers why it happens, and this post covers what one of them can reach once it is installed.

What Is Session Hijacking?

Session hijacking is an attacker reusing the session cookie your staff member’s browser already holds. The cookie is a bearer token, so whoever has it is treated as the signed-in user, with no password and no second factor asked for.

Information-stealing malware, known in the industry as an infostealer, is built for cookie theft. It lifts the browser’s cookie store and its saved password store in one pass.

Older write-ups call the same move pass-the-cookie.

A cookie is worth more to an attacker than a password, because it arrives already authenticated and skips whatever you have put in front of the login.

Does resetting a password end a hijacked session?

No. Resetting the password blocks the next sign-in, and the existing session keeps working until its token expires or somebody revokes it.

Microsoft’s guidance on revoking access sets out the order: disable the account, revoke the refresh tokens, then disable the registered devices.

Access tokens from Microsoft Entra ID last an hour by default, and Entra cannot revoke a session token that an application issued for itself, so app-side sessions have to be ended in the app.

Write the revocation step into your incident plan as a command someone can run, with a blank for the account name. Whoever picks it up on the day should not be interpreting anything.

Most incident checklists stop at the password reset.

Does multi-factor authentication stop token replay?

No. Multi-factor authentication, shortened to MFA, protects the moment of sign-in, and a replayed session token skips that moment.

The same limit applies to a stronger credential. Passkeys take the password out of the login, and a session already established on a compromised device can still be taken.

Put the revoke step on the leaver checklist too, because a departing staff member’s open sessions outlive their password in exactly the same way.

How Do You Know If a Session Has Been Hijacked?

From the sign-in logs. A stolen session shows up as your finance manager signing in from somewhere she has never worked, at a time she was asleep, while her laptop looks completely normal.

Your endpoint tools will not catch it. Nothing was installed and nothing ran on the machine, so the security agent has nothing to report.

You almost certainly hold these logs already, because Microsoft 365 keeps a sign-in record for every account, and reading them sits inside most managed IT plans.

What shows up in the sign-in logs?

Ask your IT provider to look for three signals.

• A sign-in from a country nobody travelled to.
• A sign-in from a type of device the person does not own.
• A sign-in that succeeded without anyone typing a password or approving a prompt.

The last of those matters most, because it means somebody reused a session that was already open.

Then look at the mailbox rules. An attacker working inside a mail session usually adds one that moves supplier replies out of the inbox, so an invoice change can run for weeks before anyone notices.

What are the first moves after a session hijack?

Revoke the sessions, then reset the password, then work out what changed while the session was open. The order matters, because a reset on its own leaves the attacker signed in.

After that, check the mailbox rules and any device newly registered against the account.

Then tell anyone who was emailed from that account during the window, because the messages they received were genuine and came from a real mailbox.

Should Work and Personal Browsing Be Separated?

Yes. Signing a work profile and a personal account into the same browser opens a data path between them, and sync carries data across it.

Profiles are built into Chrome and Edge already, so this is a setting, and it holds without anybody having to remember it. Only the work profile carries your company policy.

What leaves the business when a browser syncs to a personal account?

Bookmarks, saved passwords, history and open tabs, into an account the business does not control. Sync was designed to move a person’s browsing between their own devices, and it does that job regardless of who owns the data.

A leaver with a personal Chrome profile on a work laptop takes the synced copy home, and no offboarding step touches it.

Sync also runs the other way. An extension approved on somebody’s home machine can appear on the work laptop the next time the profile syncs.

Managed profiles can block sign-in to consumer accounts, which closes the path.

Where should staff keep work passwords?

In the business vault. The browser password manager was built for convenience on a personal device, so it carries no shared access and no audit trail.

Our guide to choosing a vault for the whole team already answers the comparison in detail.

Set the security case aside for a moment. A browser store cannot hand a credential to the person covering annual leave, so staff end up emailing passwords to each other.

Watch the switch-off. Chrome’s policy documentation is explicit that disabling the built-in store stops new saves while passwords already saved will still work, so clearing the old entries is a separate job.

What Does a Managed Browser Policy Control?

Five settings, and you want all five from day one.

• Which extensions are allowed to install.
• Whether the browser’s built-in password store is available.
• Whether work and personal profiles are kept separate.
• How browser updates are applied.
• What happens to open sessions when someone leaves.

Chrome and Edge both accept policy through group policy on Windows, through a cloud console, or through a mobile device management platform. Chrome’s console was called Chrome Browser Cloud Management and is now Chrome Enterprise Core, which matters when you go looking for it.

A policy applies itself at start-up on every managed machine, without depending on staff having read an email about it.

Start narrow. An allow-list and the built-in password store turned off will cover most of the exposure in a first pass, and the rest can follow at the next review.

How do you allow-list extensions without blocking real work?

Block everything by default, then add back what people need. Chrome’s blocklist policy documentation describes the mechanism: a blocklist value of an asterisk blocks all extensions by default, and extensions named in the allowlist are permitted if they are signed.

Start by collecting what is installed and asking each team what it uses. A first pass usually approves about a dozen and retires a long tail no team will vouch for.

The same documentation notes that an extension already installed is disabled once the blocklist catches it, with no way for the user to turn it back on. Expect a handful of requests in the first fortnight.

Who keeps the policy current after it is set?

One named person, with a quarterly review in their calendar. An allow-list ages, because staff change tools and approved extensions change hands.

The review is short: read the installed-extension report, then confirm the offboarding step still revokes sessions. Put it on the same cycle as the software licence review so it has a reason to happen.

Businesses with no internal IT team fold this into a managed service. Our cyber security team treats browser policy as part of the standard build.

What Does Browser Security Cost a Small Business?

Between $10 and $25 per user a year in licensing for most businesses, plus a one-off build cost of $2,000 to $4,000. Headcount and the state of your current setup drive most of the variation.

The largest line for most businesses is the one-off inventory, because it is the first time anybody has looked. Ongoing management costs close to nothing where a managed IT plan is already in place.

What does that net out at for the illustrative firm?

About $7,200 in the first year and about $10,400 a year after that. Return to the illustrative 42-person Christchurch firm carrying about $12,800 a year in hijack losses, offboarding drag and duplicate password resets.

Policy management and the cloud console cost it about $2,400 a year. The one-off inventory and policy build come to about $3,200.

Subtract one from the other: about $7,200 avoided in year one, then about $10,400 a year.

Most of that saving is the hijack line, and it only lands once the revocation step has been tested on a live account.

What Are Browser Security Best Practices?

Six practices cover most of the risk for a small business. None of them needs new software, and the first two can be done this week.

1. List what is installed. Enrol the browsers in a cloud console and read the extension report before deciding anything.
2. Retire the extensions with no owner. Anything holding permission to read every site goes first.
3. Turn off the built-in password store, then go back and clear the passwords already saved in it.
4. Separate work profiles and block sign-in to consumer accounts on managed devices.
5. Add session revocation to the leaver checklist and to the compromised-account checklist. Test it on a real account.
6. Name the person who reviews the allow-list each quarter, and put the dates in the calendar.

Steps one to three can be done by whoever already administers Microsoft 365. Steps four to six need a decision from the business about who owns the browser.

Book a Browser Policy Review

Exodesk has supported South Island businesses since 1989 and works with clients across Canterbury, Otago and Southland from offices in Christchurch and Dunedin. A browser security review starts by showing you what is installed on your own machines. Then we set the policy that clears out the rest.

Contact us today to discuss how we can help your business or connect with us on LinkedIn to stay updated with more insights.

Frequently Asked Questions

Which browser is safest for a business?

Chrome and Edge are both fine choices for a business, because both accept enterprise policy and both update themselves without user action. Management matters more than the brand, since an unmanaged install of either one carries the same exposure. Pick one and apply policy to it.

How do I see every extension installed across the business?

Enrol the browsers in Chrome Enterprise Core or the Microsoft Edge management service, both of which report installed extensions per device. Without enrolment the only route is checking machines one at a time, which is why most businesses have never done it.

Can an extension see data inside Microsoft 365?

Yes, if it holds a host permission covering the Microsoft 365 domains, and broad permissions do. An extension with page access reads whatever is rendered on screen, so an open SharePoint document or a payroll report is visible to it unless you restrict extensions to an approved list.

Is private browsing a security control for business?

No. Private and incognito windows stop the browser keeping history and cookies on the machine after the window closes, and they change nothing else. An extension granted access to the page still reads it, and the website still records the visit.

How long does a stolen session stay usable?

Until the token expires or an administrator revokes it, which can run to weeks on services with long-lived sessions. A Microsoft Entra ID access token expires after an hour, but the refresh token behind it will keep issuing replacements until somebody cancels it. Some applications issue their own session cookie as well, and that one has to be ended inside the application. Treat any session on a compromised device as live until you have revoked it.

What is an infostealer?

An infostealer is malware built to harvest saved browser passwords and session cookies from a device and send them to an attacker. It does not encrypt files or announce itself, so businesses usually learn about it when the stolen data gets used. Infostealer logs make up a large share of what is traded on criminal marketplaces.

What is an enterprise browser, and do we need one?

An enterprise browser is a separately licensed browser built for company control, usually adding browser isolation, data-loss rules and session recording on top of what Chrome and Edge already do. Most small and mid-sized businesses do not need one, because the policy controls built into standard Chrome and Edge cover extensions, the password store, profiles and updates. It mostly pays off where contractors work from devices you do not manage.

How much does browser management cost per user?

Central browser management runs about $10 to $25 per user a year for most New Zealand businesses, and it is often bundled into an existing managed IT plan. Add a one-off $2,000 to $4,000 for the first inventory and policy build. Extension risk monitoring sits higher, at $20 to $60 per user a year.

Should staff sign in to Chrome with a work account?

Yes, on managed devices. Signing in with a work identity attaches the profile to company policy and to the reporting console, so an administrator can see what is installed. Then stop that same profile signing in to a personal Google or Microsoft account, so nothing syncs out of the business. Staff can still run a separate personal profile on the same machine.

Who handles browser security in Christchurch and Dunedin?

Exodesk looks after business browsers for clients across Canterbury, Otago and Southland, working from offices in Christchurch and Dunedin. The work covers extension allow-lists, blocking the built-in password store, separating work profiles, and adding session revocation to offboarding. Exodesk has operated since 1989 and supports IT, cloud, cyber security and AI for New Zealand businesses. A browser policy review is the usual starting point.

Should staff be allowed to install browser extensions?

No, not without approval. Any extension a staff member installs runs with whatever permissions it asked for, which is often the right to read every page including payroll and banking. Run an approved list and a short request process so people can still get the tools they need.

What is the single most valuable browser setting to change?

Turn off the browser’s built-in password store on managed devices, then clear the credentials already saved in it. That one change removes a copy of the company’s passwords from every laptop and pushes staff into the vault.