Summary

Add centralized browser extension control to ESPM, similar in spirit to how RMM Guard handles remote access tools. Partners should be able to allowlist and blocklist specific extensions, force-install approved extensions, and keep them automatically updated across Chrome, Edge, Firefox, and other Chromium-based browsers, all from the Huntress portal.

The Problem

Browser extensions are one of the least-governed attack surfaces on the endpoint. Malicious or compromised extensions can steal session cookies, harvest credentials, inject ads or scripts, and exfiltrate data, often without triggering traditional EDR detections. Legitimate extensions are also regularly sold to new owners and turned malicious through a silent update.

Today, MSPs have to manage this through a patchwork of GPO, Intune configuration profiles, or RMM scripts that write browser policy registry keys. That approach is inconsistent across clients, hard to audit, and gives no visibility into what's actually installed. Since ESPM already manages security posture at the endpoint level, it's the natural home for this control.

Proposed Core Functionality

Allowlist mode. Only approved extensions can be installed; everything else is blocked. This is ideal for locked-down environments like healthcare, finance, and legal clients.

Blocklist mode. Everything is permitted except specifically blocked extensions. This is a lighter-touch option for clients who need flexibility but want to eliminate known-bad or unwanted tools.

Force-install and auto-update. Push required extensions (password managers, security tools, company-approved productivity add-ons) to every browser in scope, prevent users from removing them, and keep them on the latest version automatically.

Multi-browser support. One policy applied consistently to Chrome, Edge, Firefox, and Brave, rather than managing each browser separately.

Policy inheritance. Set a baseline at the partner level, then override at the organization, site, or device group level, matching how other ESPM policies already work.

Additional Quality-of-Life Features

Fleet-wide extension inventory. A searchable view of every extension installed across all endpoints, showing extension name, ID, version, browser, publisher, install count, and which devices have it. This alone would be hugely valuable even before enforcement is turned on.

Audit/monitor-only mode. Deploy a policy in report-only mode first so partners can see what would be blocked before enforcing it. This prevents breaking a client's workflow on day one.

Risk scoring and permission analysis. Flag extensions that request high-risk permissions (read and change data on all websites, access cookies, capture screen, manage downloads), have few users or low ratings, come from unverified publishers, or were recently transferred to a new owner.

Block by permission, not just by ID. Allow policies like "block any extension requesting access to all sites" so partners don't have to chase individual extension IDs.

Huntress SOC-curated threat feed. Automatically block extensions that the SOC has identified as malicious, or that have been pulled from the Chrome Web Store or Edge Add-ons store for policy violations. This is where Huntress could really differentiate the feature.

Alerts on new or unapproved extensions. Notify when a new extension appears in an environment or when a user attempts to install a blocked one, with optional PSA ticket creation.

Automatic removal of existing violations. When a policy is applied, remove any already-installed extensions that violate it, rather than only preventing future installs.

Block sideloaded and developer-mode extensions. Prevent users from loading unpacked extensions or enabling developer mode, a common bypass for store-based controls.

Version pinning. Optionally lock a critical extension to a specific version if an update causes compatibility problems, with an easy path back to auto-update.

Prebuilt templates. Starter policies such as "Common password managers," "Known adware/coupon extensions," or "Healthcare baseline" to speed up onboarding for new clients.

Extension lookup helper. Paste a Web Store URL or search by name and have the portal resolve the extension ID automatically, instead of partners hunting for IDs manually.

End-user request workflow. When an extension is blocked, give the user a simple way to request approval, routed to the MSP for a one-click approve or deny.

Private/incognito mode controls. Define whether approved extensions are allowed to run in incognito or InPrivate windows.

Reporting and export. Scheduled or on-demand reports showing policy compliance, blocked install attempts, and extension inventory per client, suitable for QBRs and compliance audits (HIPAA, CMMC, cyber insurance questionnaires).

Why This Matters for Partners

This gives MSPs a single pane of glass for a threat vector that is growing rapidly but remains largely unmanaged. It reduces reliance on custom scripts and GPO sprawl, gives clients a tangible, reportable security improvement, and fits naturally alongside RMM Guard as part of Huntress's broader story of controlling what's allowed to run on the endpoint.