[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fPd7gQHN7nNMQ9__oBooizbS1FNeLXZL8eUX3DYxmN1k":3},{"article":4,"iocs":48,"watch_terms":49,"solutions":50,"lesson":129},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":25,"category":26,"article_tags":30},"3b3ebf51-63a1-4625-bc19-eea8cb01fca5","How to Audit Browser Extensions for Supply-Chain Risk","how-to-audit-browser-extensions-for-supply-chain-risk-bd5d7d","Most people install browser extensions the way they install phone apps: quickly, for one small task, and then forget about them. A coupon finder, a grammar checker, a tab manager, a screenshot tool. Each one feels harmless. But an extension isn’t a static piece of software. It updates silently, it can change owners, and it […]","Browser extensions represent a significant, often overlooked, supply-chain risk because they update silently, can change ownership, and often have broad permissions to access user data. Attackers can compromise developer accounts to push malicious updates, stealing session data and credentials, as seen with extensions like The Great Suspender and others targeting Facebook advertising accounts. Security-conscious users and organizations can mitigate this risk by auditing installed extensions regularly and using specialized browsers that isolate profiles and extensions.","Browser extensions pose supply-chain risks due to silent updates and potential ownership changes.","https:\u002F\u002Fwww.cyberkendra.com\u002F2026\u002F11\u002Fhow-to-audit-browser-extensions-for-supply-chain-risk.html","https:\u002F\u002Fwww.cyberkendra.com\u002Fwp-content\u002Fuploads\u002F2026\u002F11\u002Fbrowser-supply-chain-1024x576.webp","2026-11-11T19:01:28+00:00","2026-11-11T20:00:19.588171+00:00",7,[17,20,23],{"name":18,"type":19},"The Great Suspender","product",{"name":21,"type":22},"Cyberhaven","vendor",{"name":24,"type":19},"Afina anti-detect browser","26b0b636-0e31-4db1-bffb-61bdf9f20a58",{"id":25,"icon":27,"name":28,"slug":29},null,"Supply Chain","supply-chain",[31,36,38,43],{"category":32},{"id":33,"icon":27,"name":34,"slug":35},"02371804-cf6d-4449-98de-f1a2d4d9b266","Tools","tools",{"category":37},{"id":25,"icon":27,"name":28,"slug":29},{"category":39},{"id":40,"icon":27,"name":41,"slug":42},"80544778-fabb-4dcd-aa35-17492e5dcf4f","Vulnerabilities","vulnerabilities",{"category":44},{"id":45,"icon":27,"name":46,"slug":47},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[],[21,18,24],{"controls":51,"vendors":128},[52,73,99],{"slug":53,"name":54,"problem":55,"products":56},"endpoint-management","Device management (MDM and UEM)","Every company laptop and phone is known, encrypted, locked down and up to date.",[57,65],{"vendor_slug":58,"vendor_name":59,"vendor_logo":60,"product_slug":61,"product_name":62,"url":63,"description":64},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"vendor_slug":66,"vendor_name":67,"vendor_logo":68,"product_slug":69,"product_name":70,"url":71,"description":72},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"slug":74,"name":75,"problem":76,"products":77},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them.",[78,86,92],{"vendor_slug":79,"vendor_name":80,"vendor_logo":81,"product_slug":82,"product_name":83,"url":84,"description":85},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-sat","Huntress Managed Security Awareness Training","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fsecurity-awareness-training","Security awareness training and phishing simulation, managed for you.",{"vendor_slug":87,"vendor_name":88,"vendor_logo":89,"product_slug":87,"product_name":88,"url":90,"description":91},"hoxhunt","Hoxhunt","\u002Fvendor-logos\u002Fhoxhunt.png","https:\u002F\u002Fhoxhunt.com\u002F","Adaptive phishing simulations and micro-training, with a focus on reporting.",{"vendor_slug":93,"vendor_name":94,"vendor_logo":95,"product_slug":93,"product_name":96,"url":97,"description":98},"sosafe","SoSafe","\u002Fvendor-logos\u002Fsosafe.png","SoSafe Awareness Platform","https:\u002F\u002Fsosafe-awareness.com\u002F","Behaviour-based awareness training and phishing simulation in many languages.",{"slug":100,"name":101,"problem":102,"products":103},"software-supply-chain","Software supply chain security","Malicious and vulnerable open-source packages are caught before they ship.",[104,112,120],{"vendor_slug":105,"vendor_name":106,"vendor_logo":107,"product_slug":108,"product_name":109,"url":110,"description":111},"snyk","Snyk","\u002Fvendor-logos\u002Fsnyk.png","snyk-open-source","Snyk Open Source","https:\u002F\u002Fsnyk.io\u002Fproduct\u002Fopen-source-security-management\u002F","Finds and fixes vulnerable open-source dependencies in code and pipelines.",{"vendor_slug":113,"vendor_name":114,"vendor_logo":115,"product_slug":116,"product_name":117,"url":118,"description":119},"sonatype","Sonatype","\u002Fvendor-logos\u002Fsonatype.png","sonatype-firewall","Sonatype Firewall","https:\u002F\u002Fwww.sonatype.com\u002Fproducts\u002Fsonatype-firewall","Blocks malicious and policy-violating open-source components at download.",{"vendor_slug":121,"vendor_name":122,"vendor_logo":123,"product_slug":124,"product_name":125,"url":126,"description":127},"jfrog","JFrog","\u002Fvendor-logos\u002Fjfrog.png","jfrog-curation","JFrog Curation","https:\u002F\u002Fjfrog.com\u002Fcuration\u002F","Blocks malicious and risky open-source packages before they enter your repositories.",[],{"slug":130,"title":131,"body":132,"framework_refs":133,"framework_notes":139},"browser-extensions-are-a-silent-supply-chain-threat","Browser Extensions Are a Silent Supply-Chain Threat","Browser extensions pose a serious supply-chain risk because they silently auto-update, can change ownership, and routinely hold broad permissions to access session data, credentials, and browsing activity. Attackers have exploited this by compromising developer accounts to push malicious updates — as seen with The Great Suspender and campaigns targeting Facebook advertising accounts — turning trusted tools into credential-stealing malware. Organizations rarely inventory or govern browser extensions with the same rigor applied to software packages, leaving a wide-open attack surface. This matters because a single compromised extension can expose authenticated sessions and sensitive data across an entire workforce.",[134,135,136,137,138],"CIS Control 2: Inventory and Control of Software Assets (v8)","NIS2 Article 21(2)(d)","NIST SP 800-53 SA-12: Supply Chain Protection","NIST CSF 2.0 ID.AM-2: Software, services, and systems inventories are maintained","MITRE ATT&CK T1195.001: Compromise Software Dependencies and Development Tools",{"NIS2 Article 21(2)(d)":140,"NIST SP 800-53 SA-12: Supply Chain Protection":141,"CIS Control 2: Inventory and Control of Software Assets (v8)":142,"MITRE ATT&CK T1195.001: Compromise Software Dependencies and Development Tools":143,"NIST CSF 2.0 ID.AM-2: Software, services, and systems inventories are maintained":144},"NIS2 Article 21(2)(d) mandates supply-chain security measures including policies on the security of relationships with direct suppliers, directly applicable to managing third-party browser extension risk.","SA-12 requires organizations to implement safeguards to protect against supply-chain threats, which covers vetting and continuously monitoring third-party software components like browser extensions.","CIS Control 2 requires maintaining an inventory of all authorized software, which would have prompted organizations to track, approve, and periodically re-evaluate browser extensions as software assets.","This technique describes adversaries compromising third-party software supply chains — exactly how attackers hijacked developer accounts to push malicious extension updates.","This category requires that software inventories be maintained, which would have led organizations to discover, assess, and govern installed browser extensions before a compromise occurred."]