Means
Ability to Modify Cloud Resources
Access
Aiding and Abetting
Bluetooth
Bring Your Own Device (BYOD)
Clipboard
Delegated Access via Managed Service Providers
FTP Servers
Installed Software
Media Capture
Network Attached Storage
Physical Disk Access
Placement
Printing
Privileged Access
Removable Media
Screenshots and Screen Recording
Sensitivity Label Leakage
SMB File Sharing
SSH Servers
System Startup Firmware Access
Unauthorized Access to Unassigned Hardware
Unmanaged Credential Storage
Unrestricted Software Installation
Unrevoked Access
Web Access
- ID: ME003.004
- Created: 25th May 2024
- Updated: 01st August 2025
- Contributor: The ITM Team
Browser Extensions
The organization permits the installation or execution of unapproved browser extensions, introducing a mechanism by which web-accessible systems, authentication workflows, or data transactions can be intercepted, altered, or exploited. These extensions often operate with elevated browser-level permissions, including access to cookies, session tokens, clipboard content, keystrokes, or internal URLs. In environments where business systems are browser-based and authenticated via SSO or tokenized workflows, this exposure enables passive surveillance or active manipulation of sensitive operations.
Unapproved extensions typically fall outside the control perimeter of traditional endpoint detection tools or access control frameworks. When extension installation is user-controlled or unmonitored, it creates a circumstance in which subjects - intentionally or otherwise - can introduce new capabilities for access, data exfiltration, or surveillance. This includes extensions sourced from public repositories, sideloaded packages, or internally developed tools lacking code review or deployment controls.
The presence of ungoverned extension capability constitutes a durable and distributed access mechanism, especially in cloud-forward or hybrid environments where browser access is the primary interface to organizational systems. In many cases, infringement is made possible not by elevated privilege in the operating system, but by the absence of control within the browser execution layer.
Prevention
| ID | Name | Description |
|---|---|---|
| PV029 | Enterprise-Managed Web Browsers | An enterprise-managed browser is a web browser controlled by an organization to enforce security policies, manage employee access, and ensure compliance. It allows IT administrators to monitor and restrict browsing activities, apply security updates, and integrate with other enterprise tools for a secure browsing environment. |
Detection
| ID | Name | Description |
|---|---|---|
| DT060 | Chrome Browser Extensions | Google's Chrome browser stores details about any browser extensions that are installed, providing the user with additional functionality.
On Windows, this information is stored in the following location: |
| DT019 | Chrome Browser History | Google's Chrome browser stores the history of accessed websites and files downloaded.
On Windows, this information is stored in the following location:
On macOS:
On Linux:
Where This database file can be opened in software such as DB Browser For SQLite. The ‘downloads’ and ‘urls’ tables are of immediate interest to understand recent activity within Chrome. |
| DT018 | Edge Browser History | Microsoft's Edge browser stores the history of accessed websites and files downloaded.
On Windows, this information is stored in the following location:
On macOS:
On Linux:
Where This database file can be opened in software such as DB Browser For SQLite. The ‘downloads’ and ‘urls’ tables are of immediate interest to understand recent activity within Chrome. |
| DT017 | Firefox Browser History | Mozilla's Firefox browser stores the history of accessed websites.
On Windows, this information is stored in the following location:
On macOS:
On Linux:
In this location two database files are relevant, These database files can be opened in software such as DB Browser For SQLite. |