Who it suits
Anyone whose staff work in a web browser, which is everyone. Especially useful if nobody manages the office computers.
The problem
A browser extension that writes emails for you, summarizes pages, or fixes your grammar has to read the page to work. Many can read every page you open, which includes your client database, your email, and your bank. That permission is granted once at install and then forgotten.
Extensions are also sold and change hands. An extension that was safe last year can belong to a different company today with the same permissions. This checklist is a short audit you can repeat.
The checklist
- Open the extensions page on each computer.
Every browser has one. List what is installed, including things nobody remembers adding.
- Read the permissions for each one.
Look for the phrase about reading and changing data on all websites. That is the one that matters.
- Remove anything nobody can explain.
If no one knows what it is for, it goes. You can always reinstall it.
- Decide on the ones that read everything.
Keep only the ones the organization chose, with an account you control. Personal-account AI helpers on work machines should go.
- Check the AI features inside the browser itself.
Browsers now ship their own assistants. Find the setting and decide whether it is on.
- Do the same on phones.
Keyboard apps and share-sheet helpers can read what you type, and the same rules apply.
- Set a rule for new installs.
Ask before installing anything that reads pages. One message to the team is enough.
- Repeat every six months.
Put it on the calendar. Extensions change owners without telling you.
If you find a problem
If you find an extension that reads all pages and belongs to a company you cannot identify, remove it, then change the passwords for the accounts that computer uses most, starting with email and banking. If the computer touches client data, note what you found and when.