The Add-Ons You Inherited: A 30-Minute Browser Extension Review for UK Teams

Most UK teams have a browser policy. It usually names Chrome, Edge or Safari, mentions a managed profile, and says something sensible about not installing random things. Then the working week happens. Someone adds a grammar checker. Someone else adds a screenshot tool. A tab manager arrives, then a coupon finder, then a PDF widget that has been quietly reading every page for years. The browser monoculture is one security surface; the extensions inside it are another. Unlike the browser itself, they rarely get an owner, a review date or a proper goodbye.

That is the gap this review fills. It is not a purge. It is not a 40-page policy. It is a 30-minute team exercise you can run this month, with a shared spreadsheet and a mildly awkward question: who actually uses this thing?

Why this belongs on the team agenda

Extensions are small pieces of software that sit inside the browser and often ask for broad access. Some need that access to work. A password manager needs to fill fields. A screen reader helper needs to read pages. But plenty of add-ons ask for more than the job requires, and permissions can expand after an update. A tool that started as a simple highlighter can later request access to every site you visit.

The risk is not only malicious extensions. It is forgotten ones. An add-on installed by a former colleague, tied to a personal account, or bought by a new publisher is still running in the browser. If nobody owns it, nobody notices when it changes. For UK teams handling client data, personal information or anything that touches the GDPR, that is an uncomfortable loose end.

There is a productivity angle too. Every extension adds a button, a pop-up, a background process and a small decision. Ten half-used add-ons make a browser feel busy without making the work faster. A short review often recovers a surprising amount of calm.

The 30-minute agenda

Block half an hour. Ask everyone who uses a work browser to join, including contractors and anyone who uses a personal profile for work. Keep it practical: one shared document, one nominated note-taker, no slide deck.

0–5 minutes: Inventory every profile

Ask people to open their browser’s extension page. In Chrome, it is chrome://extensions. In Edge, edge://extensions. On Safari for macOS, it is Settings, then Extensions. If your team uses managed browsers, check whether IT already has an allowlist. Do not assume it covers the personal profile someone uses for work on a Friday afternoon.

For each add-on, note four things: the name, the publisher, who uses it, and the scariest permission in plain English. Do not try to judge yet. Just get the list. The goal is visibility, not a verdict.

5–15 minutes: Sort by permission, not by logo

Now group the list by what each extension can see or do. Browser permission labels vary, but the broad categories are familiar. Anything that says it can read and change all data on all websites deserves a second look. So does access to browsing history, downloads, clipboard content, cookies, or the ability to communicate with native applications. A debugger permission is especially powerful and rarely needed for everyday tools.

This is not a ban list. It is a sorting exercise. A trusted password manager with broad site access may be entirely reasonable. A novelty theme with the same access is not. The question is whether the permission matches the job, and whether the person using it can explain why.

15–25 minutes: Match each add-on to a real job

Put every extension into one of three buckets: keep, replace, remove.

Keep means there is a named owner, a clear work purpose, and a permission set that makes sense. Replace means the job still exists, but a built-in browser feature or an approved work tool can do it with less access. Remove means nobody claims it, the publisher is unclear, or it has not been used since the last team reshuffle.

Be honest about the boring cases. Coupon and cashback extensions often ask for wide access to save a few pounds. PDF mergers, screenshot tools and form fillers are frequently installed for one task and then left behind. If an extension is only needed for one site, check whether the browser can limit its access to that site, or whether it can be set to run only when clicked.

25–30 minutes: Write the approval rule

Keep the rule short enough that people will actually follow it. A workable version has three questions: What job does this extension do? Which sites does it need to access? Who owns it if something goes wrong? Add a fourth for high-access tools: has the publisher been checked?

Put those questions in a shared form. New installs need an answer before they go into a work profile. Existing extensions can be grandfathered until the next quarterly check, but give them a review date now. The rule should feel like a permission slip, not a border checkpoint. Most people will answer in two minutes. The point is to create a record, not to make anyone beg.

What good looks like afterwards

A good outcome is not an empty extension list. It is a list where every add-on has a reason to be there. Passwords managers, accessibility tools, approved research helpers and a couple of genuinely useful productivity add-ons can all survive. What disappears is the stuff nobody can justify.

Add two habits. First, a ten-minute quarterly check: open the extension page, remove anything unclaimed, and confirm the owner still works here. Second, an offboarding step: when someone leaves, remove their browser extensions along with their accounts. That second habit is easy to forget and oddly powerful.

For UK teams, this also makes conversations with IT and data protection leads much easier. You are not asking for a huge security programme. You are asking for a list, a reason and a review date. That is a credible position in any organisation, whether you run Google Workspace, Microsoft 365 or a cheerful mix of both.

The point is not zero extensions

Extensions are part of how modern work gets done. The aim is to stop treating them as invisible. Your browser choice may be standardised, but the add-ons inside it are a living collection of small decisions. Thirty minutes is enough to find out what you have inherited, what still earns its place, and who is responsible for the next install. That is a better use of a team meeting than another status update.