Someone in your company has between 8 and 15 browser extensions installed. Grammarly, a ChatGPT sidebar, Loom, a spell checker, a screen capture tool, perhaps some sales prospecting utility. Every one of them has permission to read the content of the pages that user visits. Including your CRM. Including the emails with clients. Including the contracts being reviewed in Google Drive.
This isn’t hypothetical. It’s the default configuration at most B2B companies that haven’t reviewed this. And with the proliferation of AI tools built into the browser, the problem has intensified quietly over the last eighteen months.
The risk isn’t “being hacked”. It’s that data leaves through completely legitimate channels, with explicit permission nobody remembers granting.
Why the browser became your company’s most vulnerable point
For years, corporate security concentrated on the perimeter: firewall, antivirus, passwords. That made sense when work happened on internal servers. The problem is that from 2020 onwards, work happened in the browser.
Today the browser is the most critical application in any B2B services company. From it you reach the ERP, the email, the commercial proposals, the video calls, the financial reports. And that same browser has extensions installed which, by design, can read everything appearing on screen.
Browser extensions operate on a permissions model designed for usefulness, not corporate security. When you install an extension and accept that it “access all websites”, you’re granting read capability over any page you open in that session. That includes your management system’s internal pages, the documents you review online, and the forms you fill in with sensitive information.
The important change of the last two years is that this model already existed, but AI extensions took it to another level. An AI extension doesn’t just read the page content: it processes it, sends it to external servers to generate responses, and in many cases uses it to improve its models. The difference between an extension that “reads” and one that “learns from what it reads” matters to any company handling client information, pricing or internal processes.
The real problem isn’t the extension — it’s the permissions model nobody audited
There’s a frequent confusion here: many companies assume that if the tool comes from a recognised brand, the data is safe. Grammarly, for instance, has more than 30 million users and a detailed privacy policy. But that doesn’t mean it’s appropriate for it to process the emails where your sales team negotiates terms with a client.
The underlying problem is structural: B2B companies don’t have a defined process for evaluating which extensions can be installed on corporate devices. Each person installs whatever they find useful. The IT function, where one exists, manages antivirus and updates but rarely has visibility over browser extensions. And management assumes that if nobody has reported an incident, there’s no risk.
Three patterns the PTW team finds frequently when reviewing a B2B company’s digital presence:
First, extensions installed by an employee two years ago that remain active even though that person no longer works there. Their replacement’s browser inherited the synced profile, extensions and permissions included.
Second, AI productivity tools the sales team adopted independently because “it saves time on emails”. Nobody assessed which servers the processed content is sent to, or under which legal jurisdiction that company operates.
Third, lead capture or prospecting extensions with access to LinkedIn, email and the CRM simultaneously, cross-referencing data in ways no internal policy anticipated.
According to an Incogni report published in 2024, 48% of the most popular Chrome extensions request permissions beyond what they need to function. Not because they’re malicious, but because the extension development model incentivises asking for broad permissions to guarantee compatibility.
How to assess the real risk: a concrete process
You don’t need a cybersecurity team to make a first assessment. What follows is a process any manager can start this week.
Step 1: Inventory what’s installed
The first problem is a lack of visibility. To solve it:
- In Chrome, open
chrome://extensionson each relevant corporate computer - In Edge, it’s
edge://extensions - Document the name, version and whether it’s active
- Pay particular attention to extensions with the permission “Read and change all your data on all websites”
If your company has more than 20 people, this requires coordination with IT or whoever administers the devices. The objective of this step isn’t to remove anything yet — it’s to know what exists.
Step 2: Classify by access level and data type
Once you have the inventory, the relevant question isn’t “is this extension bad?” but “what data can this extension reach, and what does it do with it?”
Evaluation checklist per extension:
- Does it have access to all sites, or only specific domains?
- Does it process content on the provider’s server, or locally?
- Does the company developing it have a privacy policy with explicit data retention terms?
- Does it operate under legislation establishing clear data protection obligations?
- Is it installed on profiles that access financial or client information?
- Was it installed by someone who no longer works at the company?
Any extension that doesn’t pass this review with clear answers deserves to be uninstalled or replaced with an alternative that has more transparent policies.
Step 3: Establish a minimum policy going forward
The objective isn’t banning useful tools. It’s establishing clear criteria before installing, not after data has already circulated.
A minimum viable policy includes:
- A list of approved extensions for profiles accessing sensitive information
- A request process for installing new tools on corporate devices
- Quarterly review of the extension inventory
- Unlinking corporate browser profiles when an employee leaves
This requires no technology investment. It requires judgement and consistency.
What this has to do with your corporate digital presence
It may seem this topic is disconnected from your company’s website. It isn’t.
When PTW runs a digital diagnostic for a B2B company, part of the analysis covers the technical base the digital presence operates on: which tools have access to which data, which third-party scripts run on the site, what information is processed outside the company’s control. A B2B company’s corporate website isn’t just a shopfront — it’s a digital asset processing enquiries, contact forms and, in many cases, potential clients’ data.
Many companies invest in a well-built site and then install plugins, chat tools, third-party analytics scripts and AI widgets without judgement, transmitting data beyond their control. The result is a technically solid digital asset with a weak privacy foundation.
The risk isn’t only regulatory. In Australia, obligations under the Privacy Act have been tightening, and the direction of reform is clear: companies handling third-party data are being held to a higher standard. Businesses that today have no control over which extensions read their corporate email, or which scripts process their web form data, will have to put that picture in order regardless.
The next step, if this applies to you
If reading this you recognised that your company has no visibility over the extensions installed in the sales team’s browsers, or that the corporate website has third-party scripts whose reach nobody has reviewed, there’s a concrete starting point.
PTW’s digital diagnostic includes a review of your digital presence’s technical base: not only speed and technical SEO, but which third-party tools have access to which data and where the most relevant risk points sit for a company of your size. It isn’t a cybersecurity audit — it’s a strategic assessment of how your corporate digital asset is operating.
If your company’s website is running on a technical base nobody has reviewed in two years, that’s where to start.