Quietly, over a decade, the browser became the workplace: email, the cloud files, the CRM, the accounting system, the whole SaaS stack — all of it living in tabs. Which makes the browser the most-used, most-exposed application in the business — and, at most businesses, the least managed: every machine running whatever version, whatever extensions, whatever settings each user clicked into existence. The good news is that the major browsers ship enterprise management that most businesses simply never turn on. Here’s what actually needs governing, and the light-touch way to do it.
Threat one: extensions — apps with a costume
Extensions are software with sweeping permissions (“read and change all your data on all websites” is a standard extension grant), installed by anyone, from a marketplace where useful tools and data-harvesters share shelf space — and where legitimate extensions get quietly sold to new owners who monetize the installed base. An extension with page-reading rights sees every password typed, every client record displayed, every mail opened — it’s the app-consent problem wearing a browser costume, and the answer rhymes: an allow-list posture via managed policy — the sanctioned extensions (the password manager, the ad-blocker, the tools work actually needs) permitted, new requests answered within a day, the long tail blocked by default. On an unmanaged fleet, start smaller: an audit of what’s currently installed across machines — always educational — and removal of the obvious junk.
Threat two: the browser’s own password store
Browsers helpfully offer to remember every password — creating, on each machine, an unmanaged credential vault outside every control you’ve built: not visible to IT, not governed by offboarding, synced to whatever personal account the user signed the browser into (a subtle, common leak: work passwords riding a personal sync to home devices), and harvested wholesale by commodity infostealer malware — whose first stop on any compromised machine is exactly this store. The fix is a pairing: the business password manager doing the remembering, and managed policy disabling the browser’s built-in saving — in that order, gently, after the manager has adoption, because removing the crutch before providing the replacement just breeds sticky notes.
Threat three: version drift and the settings nobody set
The browser parses hostile content from the internet all day, which is why it’s among the most-patched software on earth — and browser updates only apply on restart, which some users avoid for weeks (the “47 tabs” lifestyle). Patch discipline here means policy-enforced update deadlines: the browser relaunches within a defined window, grumbling tolerated. And a handful of managed settings close the everyday gaps: safe-browsing protections on their stricter tier · the browser signed into the work profile with personal/work sync separated · pop-up and notification permissions tamed (browser notifications are a phishing channel now — the fake “virus detected” spam runs through them) · and downloads pointed at scanned, sensible defaults.
The mechanism: enterprise policy, already in the box
None of the above requires new products: Chrome, Edge, and their kin ship policy engines (via Microsoft’s management tools, Intune, or Google’s console) that centrally enforce every setting named here — extension lists, password-store behavior, update deadlines, sync boundaries — invisibly to the user, as configuration rather than spend. The rollout logic is the usual: inventory what’s installed first, announce the why in a paragraph (the same courtesy as any policy), enforce the high-value settings, and keep the extension-request path fast enough that nobody misses the wild-west era.
The bottom line
The browser is where the work — and therefore the exposure — actually lives: extensions with page-level access, an unmanaged password vault, and update discipline left to individual restart habits. The management layer to fix all three ships free inside the browsers themselves; turning it on is an afternoon of policy plus a one-paragraph announcement. Govern the app everyone uses all day with at least the care given to the ones they use monthly — the attackers made that adjustment years ago.