Google is giving IT more control over your Chrome extensions

Google has announced some new business features that can help IT admins better manage Chrome browser extensions, a popular attack vector for cybercriminals. A curated Chrome Web Store experience is launching today for any organization using Chrome Enterprise (including the free Chrome Enterprise Core package) that allows pre-approved extensions to be displayed on the landing page, making them easier for employees to find and install.

Companies can also promote other trusted add-ons that they have vetted, create groups for specific extensions, and customize the Chrome Web Store UI with company logos, imagery, and announcements.

The aim is to prevent employees from installing potentially harmful browser extensions that pose a security risk — as seen in the phishing campaign reported in December that inserted malicious code into multiple Chrome extensions, including the Cyberhaven data security add-on.

More controls will be added for IT admins later this year, including a new setting that will enable extensions to be removed from users’ systems remotely and automatically block future downloads. Another feature, coming “early this year,” will let admins place custom messages on extension detail pages to provide more information about their compliance with workspace usage policies.

Update, January 23rd: Clarified tools are available to admins on both free Chrome Enterprise Core and Chrome Enterprise Premium.