Browser extensions at the office: the invisible risk nobody talks about

Those handy little icons in Chrome or Edge can read everything you do. Here's how to spend half an hour clearing out what you actually need — and what needs to go.

You know them well: those small icons in the top-right corner of your browser. A PDF tool, a coupon finder, a screenshot maker, a translator, a spell checker. Installed at some point because they seemed useful, and never looked at again. Most office laptops now have ten to twenty of these extensions installed. And that's exactly the problem.

Why this is riskier than you think

A browser extension is not a harmless little button. It's software that you personally grant permission to watch everything you do in your browser. During installation, you get a prompt along the lines of "This extension can read and change all your data on all websites". Almost everyone clicks yes without a second thought.

In practice, that means the extension can watch as you log in to your bank, view an invoice in your accounting package, or open a client file. Some extensions never use that access. Others quietly send data to servers whose location nobody knows.

Even more unsettling: an extension you installed two years ago from a reputable developer may since have been acquired by a different company. It happens more often than you'd think. The extension still works exactly as before, but suddenly does something extra in the background. You'd never notice.

Four situations we see in practice

• The coupon finder — Popular when ordering office supplies. Often free, because the developer earns money by tracking your browsing behaviour. What exactly gets shared is buried in the fine print.
• The PDF converter — Convenient, until you realise your invoice or contract passes through an unknown server to be converted. That can conflict with your GDPR obligations.
• The translator — Some translation extensions send everything you select to their server — including internal emails or customer data.
• The ex-employee extension — Someone installed something once, left long ago, and the extension is still there. Nobody knows what it does.

Clean up in half an hour

You don't need to be an IT professional to tackle this. Block out half an hour, do it with your colleagues over a coffee, and work through the laptops one by one.

Step 1: Get an overview

Open your browser and go to the extensions menu:

• In Chrome: type chrome://extensions in the address bar.
• In Edge: type edge://extensions.
• In Firefox: type about:addons.

You'll now see a list. The number is often a surprise.

Step 2: Ask three questions for each extension

1. Do I still know what this does? If not: remove it. You can always reinstall it if you miss it.
2. Do I use this every week? If not: remove it. Extensions you need once a year can be installed at the time you need them.
3. Do I know who made it? Click on the extension and check. Is there a recognisable company behind it, or an anonymous name? If in doubt: remove it.

Step 3: Review the permissions

For extensions you decide to keep, click "Details". Look under "Site access". Does it say "On all sites"? That extension is reading everything you do. Ask yourself whether that's really necessary. You can often change this to "When you click the extension", so it's only active when you use it.

Step 4: Make one agreement for the future

Agree with your team: we don't install new browser extensions without checking first. It sounds strict, but it will save you a lot of tidying up a year from now. And it prevents an intern from accidentally bringing in something that watches everything.

Bonus: do this for departing employees too

When someone leaves, you think about their mailbox, their laptop, their keys. But the browser extensions on their profile are often forgotten. If that laptop is reused by a colleague, they inherit all the extensions along with it. Make it part of your standard offboarding checklist.

What you gain from this

Fewer extensions means: a faster browser, fewer places where business data passes through, and fewer surprises if something ever goes wrong. It's one of those jobs nobody enjoys, but in half an hour it delivers more value than an expensive security training course.

Want to make sure your entire digital clean-up is solid — not just browsers, but also who still has access to your shared folders and systems? Our access check walks you through who can access what in just a few hours. And if you want to check your browser speed after cleaning up, use our speed test to see the difference.