Cybersecurity essentials · Lesson 7 of 7
Give browser extensions a smaller reach
A browser extension adds capabilities to a browser. Its requested permissions tell you something about the reach you are granting, not whether the extension deserves your trust.
One tool. A smaller permission boundary.
Follow the sequence, or move one step at a time.
Reduced motion is on. Use Next step to explore without animation.
Read all 4 steps
- Start with the task
The fictional tool needs to help on training.example. That purpose defines the proposed scope.
- Choose limited access
Where supported, grant only the training-site access the extension needs.
- Keep other sites outside
Email and payroll are outside this example’s granted site scope. This diagram describes intended permissions, not a real browser setting.
- Reassess a change
If the tool later requests broader reach, compare the new request with the task before deciding.
Scope follows purpose
Compare the parts before making a security decision.
- Needed
Vocabulary help on training.example.
- Outside the task
Reading unrelated email and payroll pages.
- Decision
Use narrower access where supported, or decline.
Read the visualWhat is the strongest first response to an extension requesting access to every website?
Scope should follow the task. A permission warning needs an informed decision, not automatic approval.
Match access to purpose
An extension that changes one training page should have a clear reason before it can read or change pages across unrelated sites.
Prefer a narrower scope
Where the browser supports it, consider access only when invoked or on specific sites. Some extensions need broader access to work; decide whether their benefit justifies that scope.
Review changes
Check the publisher, requested capabilities, and managed-device rules. Revisit permissions after changes and remove extensions you no longer need. An installation approval is not a permanent trust decision.
Put it in context
A fictional vocabulary helper is useful on training.example. Its permission request also covers your payroll and email sites. You choose the training-site scope if supported, or decline the extension if it cannot meet the need without excessive access.
Grant the reach the task needs, and reassess when that reach changes.
Read the sources
Make it stick.
Try one short question to check your understanding and save this lesson to your progress.