The browser extensions inventory in Defender exposes risky add-ons

In most environments I assess, patch management for the OS and major applications runs smoothly. Browser extensions and local certificates are a different story, and they usually stay off the radar. Over the past months I've come across a lot of endpoints running extensions with excessive permissions or holding expiring and self-signed certificates, often in critical user contexts. Microsoft Defender Vulnerability Management (DVM) now offers the inventory views I had been missing, with clear overviews of browser extensions and certificates, so these risks finally become visible at scale and not just on paper.

The browser extensions inventory puts permission risks in plain sight

Under Defender portal → Endpoints → Vulnerability management → Inventories → Browser extensions you get a tidy list of every detected add-on across Microsoft Edge, Chrome and Firefox, including version, publisher, permissions and install location. (Note: According to the current announcement, some views and details require the Defender Vulnerability Management add-on, or Defender for Endpoint Plan 2 plus the add-on.) Even tenants with restrictive policies usually turn up a surprising number of high-risk extensions. Many were quietly sideloaded by third-party installers or enabled by users by mistake. The actual danger lies in their permissions, because many of them can access all websites, read clipboard data or exfiltrate browsing activity.

For a quick audit I use Advanced Hunting (Defender portal → Hunting → Advanced hunting; role: Security reader or higher) with a simple query:

DeviceTvmBrowserExtensions
| summarize count() by ExtensionName, Publisher, Permissions
| sort by count_ desc

The result is a ranked list of the most widespread high-permission extensions in the environment. All fields and options are described in the official documentation. I usually start by filtering for permissions such as "All Sites" or "clipboard", since that's where the problems tend to cluster.

Practical tip: If you deploy Microsoft Edge, Intune makes it easy to block specific extensions. Go to Intune portal → Devices → Configuration profiles → Microsoft Edge settings → "Block extensions" and enter the extension ID. That shuts down known risks with very little operational overhead.

The certificates inventory exposes expiring, weak and self-signed certificates

Under Endpoints → Vulnerability management → Inventories → Certificates, Defender now lists every certificate it discovers on each endpoint. This is where I usually find:

• Certificates that expire soon (and can cause outages)
• Self-signed certificates that attackers abuse for lateral movement
• Weak signature algorithms such as SHA1 (deprecated and exploitable)
• Certificates stored outside the managed stores

Self-signed certificates are still far too common in commercial software stacks, and attackers still like them a lot. The certificate inventory documentation covers all fields and filter options.

Advanced Hunting is useful here too (same portal path). This query finds expiring or weak certificates:

DeviceTvmCertificateInfo
| where SignatureAlgorithm in ('sha1RSA', 'md5RSA') or ExpirationDate < now() + 30d
| project DeviceName, Subject, Issuer, ExpirationDate, SignatureAlgorithm

More than once I've found certificates that were about to expire or were still signed with SHA1. In production environments, those are time bombs that nobody hears ticking.

Each finding moves from the inventory to a clear response

The following Mermaid flowchart shows how a risk typically gets from discovery to mitigation in practice:

flowchart TD
    Discovery["Inventory: Extension/Certificate found"] --> Analysis["Risk analysis in portal or hunting"]
    Analysis --> Decision["Block, remove, or ignore?"]
    Decision --> Block["Block via Intune/Edge policy"]
    Decision --> Remove["Manual removal/user action"]
    Decision --> Document["Document/allow exception"]

Figure: How an item found in the inventory leads to mitigation steps.

Policies turn the inventory into actual protection

The inventory is only the first step, and the real work comes afterwards. For browser extensions, the control that works best in practice is blocking all high-risk add-ons centrally (Edge: Intune policy; Chrome: GPO or Google Admin console). If you support several browsers, you have to map policy enforcement across every approved option. Certificates take longer, but with the new inventory you can at least spot the obvious risks and hand clear remediation tasks to your PKI or endpoint management teams.

One problem keeps coming up, though. Automated removal of expired or weak certificates is rare. At the very least, set up a monthly review. Better still, use your endpoint management tool to target and remove outdated certs.

I consider the inventory mandatory rather than optional

I don't see the browser extensions inventory as a nice extra. If client security matters to you, it's simply part of the job. Too many attacks today begin with a rogue browser extension or a weak certificate. The tools exist, and rolling them out isn't hard. Once the inventory is part of your monitoring and operations process, you lower the risk and spare yourself unpleasant surprises in audits and incident response later on.