# Can a browser extension read your client’s work? Read what it asks for. > See what browser extensions can read or change in the web apps your team uses for client work, and review each one: keep it, limit it or remove it. Page: https://cybee.ai/blog/browser-extension-permissions/ (Browser extension permissions and client data) - [Blog](https://cybee.ai/blog/) - Browser extensions Mac security Proposals, CRM records and design files now live in browser tabs, right next to the extensions your team installed. Here is how to read an extension’s permissions and decide whether to keep it, limit it or remove it. By [cybee](https://cybee.ai/about/#founders) Published 21.09.2026 Updated 24.09.2026 7 minute read In one minute - Extensions sit inside the browser, next to the web apps where client work happens. - A permission such as “read and change data on all websites” gives broad access. It does not prove misuse, but it needs a clear business reason. - For each extension, make one of three decisions: keep it, limit where it runs or remove it. - Review again when an extension asks for more, when someone joins the team or when you hand over a client account. - cybee lists the extensions on your Macs and the permissions they request, free for every Mac. ## What does “read and change data on all websites” mean? It means the extension may read and change the content of the websites you open, within the limits your browser sets. That can include the work you do in web apps. The permission alone does not prove misuse, but it deserves a clear business reason. So check three things: the extension itself, the sites it can reach and whether anyone still needs it. **Q:** What is a browser extension? ### What a browser extension is. A small program you add to Chrome, Safari or another browser: a screenshot tool, a writing helper, a password manager. It runs inside the browser. Depending on its permissions, it can see the pages you open and sometimes change them. That is how many useful extensions work, and it is why the permission matters. ## The browser is part of your client workspace. Your team writes proposals in a web app, checks CRM records, shares design files and reviews code in browser tabs. Next to those tabs sit extensions installed for screenshots, writing help or passwords, and some for a task that ended months ago. An extension can sit close to sensitive work even when nobody thinks of it as business software. That is why an extension review belongs next to your app inventory. Start with the browsers and profiles people actually use for client work. Look past the icons in the toolbar: some installed extensions are hidden there, and some are switched off. Ask which ones are required, which are an occasional convenience and which nobody remembers installing. **Q:** What is a browser profile? ### What a browser profile is. A separate set of bookmarks, logins and extensions inside one browser. Many people keep one profile for work and one for their private life. Extensions belong to a profile. So check the profile each person uses for client work, not only the one that opens first. ## Understand what the permission allows. Chrome lets you review and change an extension’s site access: only when you click it, on specific sites or on all sites. Safari has its own extension settings. What you can set depends on the extension and the browser. Read the actual permission text. Do not assume every extension gets the same access or works the same way. Broad access can be legitimate for a tool that works across websites. It is still fair to ask whether that access fits the job. A screenshot tool used on one public site deserves a different conversation from an approved password manager. And do not call an extension malicious only because its permission label looks alarming. Provider guidance: [Google Chrome: manage extension site access](https://support.google.com/chrome/answer/2664769?hl=en) · [Apple: Safari extension settings](https://support.apple.com/guide/safari/change-extensions-settings-sfri32153/mac) keep limit remove Figure: The same permission, three different answers. The owner of the Mac makes each one. ## Make one of three decisions: keep, limit or remove. Keep an extension when someone can explain its purpose and its permissions fit that purpose. Limit its site access where the browser and the extension allow it. Remove tools nobody uses, and tools whose origin or behaviour you cannot explain. Before you change a shared workflow, check with the person who depends on it. Say a designer needs an extension only while looking at public websites. Limiting it to those sites keeps its value, without giving it the same reach while they work in client accounts. Test that the task still works after the change. And write down the reason for any broad access you keep, so the next person to review it knows why. keep ### Its job and its access are understood. Someone can explain why it needs the sites it reads. limit ### Less access is enough. Let it run only when clicked, or only on the sites it needs. remove ### It no longer has a useful purpose. Nobody uses it, or nobody can say where it came from. ## Review again when something changes. Extensions update, people change roles and teams start using new web apps. Look at extensions when a contractor joins or when you hand over a client account. If the browser shows a new permission request, treat it as a decision, not a reflex. Check what changed and whether the job needs the extra access. Give people an easy way to ask about a permission they do not recognise. The owner of a small studio does not need everyone to become a browser security expert. The team needs to know who can help and which tools are approved for client work. They also need to know how to report something odd without worrying about blame. > A new permission request is a decision. Not a button to click away. ## Keep the finding connected to the Mac. cybee lists browser extensions next to the installed software, AI tools and security settings on your enrolled Macs. So a founder can find an extension with broad access and ask a specific question about it. Keep three things apart: an installed extension, its permissions and evidence of what it actually did. A finding in the inventory does not prove a data leak. If you suspect misuse, keep the details and follow your incident process before you change anything that could erase useful evidence. For ordinary housekeeping, a short review with clear owners is enough to begin. What you want is fewer unexplained tools around client work, while the extensions people need keep working. Figure: The list shows what each extension asks for. What to do with it stays with the owner of the Mac. What cybee does not do here It lists extensions and the permissions they request. It does not change or remove an extension, and a permission in the list is not proof of misuse. Free for every Mac The list of apps, extensions and AI tools on your Macs is part of the free plan, next to protection and the 118 checks. [See what the Proof plan adds](https://cybee.ai/pricing/). ## What to remember. - Review the browser profiles people use for client work. - A permission describes access. It is not proof of misuse. - Keep the tools people need. Limit or remove access that no longer has a purpose. ## Sources and further reading. Written by cybee for small teams. Product scope and provider guidance can change, so check the linked source for your own setup. - [Google Chrome: manage extension site access](https://support.google.com/chrome/answer/2664769?hl=en) - [Apple: Safari extension settings](https://support.apple.com/guide/safari/change-extensions-settings-sfri32153/mac) ## See what else sits on your Macs. Apps, extensions and AI tools on one list, with what each one asks for and connects to. [What cybee lists on a Mac](https://cybee.ai/product/ai-agents/) On this page - The short answer - The browser is part of your workspace - What the permission allows - Keep, limit or remove - Review when something changes - Keep the finding with the Mac - What to remember - Sources [Look up a term](https://cybee.ai/glossary/) cybee Lists the extensions on your Macs and the permissions they request. Free for every Mac. [See how it works](https://cybee.ai/product/) ## What else can reach client work. Three more guides. [Mac security Are Macs secure enough for a small business? What your Mac already protects, and what a small team still needs to check. Read the guide](https://cybee.ai/blog/mac-security-small-business/) [Google Workspace Which apps can read your company’s Google Drive? Review forgotten app permissions in Google Workspace without stopping useful work. Read the guide](https://cybee.ai/blog/google-workspace-app-access/) [AI tools Which AI tools are on your work Mac? Find the assistants, their connections and the experiments nobody switched off. Read the guide](https://cybee.ai/blog/ai-tool-inventory/) ## Your next client will ask. Be ready. `curl -sSf https://get.cybee.dev | sh` Run it in Terminal, a chat, your IDE or a CLI. Keep working where you started. Free for every Mac with an Apple chip · Asks before it changes your Mac [What it installs](https://cybee.ai/docs/install/#see) [Read the install script](https://get.cybee.dev)