Browser extension
A browser extension is a small add-on program that adds a feature to a web browser, such as a password manager, ad blocker or PDF tool. Cyber Essentials counts extensions as software: they must be supported, updated within 14 days for critical or high-risk fixes (A6.5), and removed if unused (A5.1) or unsupported (A6.6).
- Term
- Browser extension
- Also known as
- Browser add-on, Add-on, Plug-in
- Category
- Devices and software
- Requirement area
- B. Definitions; 2. Secure Configuration; 3. Security Update Management
- Questions
- A5.1A6.2A6.5AUTO-FAILA6.6
- Reviewed against
- Requirements v3.3
What does the term browser extension mean in Cyber Essentials?
A browser extension is a small add-on program that adds a feature to a web browser, such as a password manager, ad blocker or PDF tool.
How does browser extension apply to Cyber Essentials?
In plain terms
Extensions are apps for your web browser, in the same way that apps add features to a phone. They are quick to install and easy to forget. Many can read the pages you visit, which may include your online banking, your email and your accounts system, so each one is a small piece of trust you hand to whoever wrote it.
What Cyber Essentials asks
The NCSC definition of software includes "extensions", so every software rule applies. A6.2 asks whether all software is supported and its guidance says "This includes frameworks and extensions." A6.5 asks whether critical and high-risk updates for "software (including any associated files and extensions)" are installed within 14 days, and is an automatic fail on a No. A6.6 asks whether unsupported software has been removed. Under secure configuration, A5.1 asks whether software you do not use has been removed or disabled.
Common mistakes
- Keeping an extension whose author has stopped updating it. With no fixes coming, treat it as unsupported and remove it.
- Letting everyone install any extension they like. Chrome and Edge can both be managed centrally so that only approved extensions are allowed.
- Listing the browser version at A6.2.1 but never checking what is installed inside it.
See the Google Chrome and Microsoft Edge support pages and the security update management requirements. Related: software, unnecessary software.
Related terms
- SoftwareIn Cyber Essentials, software is any operating system, off-the-shelf application, extension, interpreter, script, library, network software or firewall and router firmware.
- Unnecessary softwareUnnecessary software is any program, built-in tool or background service on a device or cloud account that the business does not use.
- BYOD (bring your own device)BYOD, short for bring your own device, means staff using their own personal phones, tablets or computers to do work.
- CVE (Common Vulnerabilities and Exposures)A CVE is a unique public reference number given to a known security flaw, so vendors, scanners and IT teams can all refer to the same problem.
- CVSS (Common Vulnerability Scoring System)CVSS, the Common Vulnerability Scoring System, is the 0 to 10 scale Cyber Essentials uses to define critical and high-risk vulnerabilities.
- Device unlockingDevice unlocking is the check, such as a PIN, password, fingerprint or face scan, that a person must pass before they can use a laptop, phone or tablet.
Frequently asked questions
A browser extension is a small add-on program that adds a feature to a web browser, such as a password manager, ad blocker or PDF tool.
In the 2026 Danzell question set, browser extension comes up at A5.1, A6.2, A6.5, A6.6. Read those questions against the definition above so your answers use the term the way the assessor will.
Browser extension relates to B. Definitions; 2. Secure Configuration; 3. Security Update Management in the NCSC's Cyber Essentials: Requirements for IT Infrastructure v3.3. Read that section for the control your answers must show.
Would you pass the 2026 question set?
Answer 24 yes or no questions, built by the assessors who mark Cyber Essentials, and get a readiness score in about five minutes, with any auto-fail questions you miss flagged first in your results.