How can a browser extension provide persistence?¶

A browser extension can remain active whenever its browser profile runs, giving continuing access to the capabilities granted by its permissions. Store availability or a familiar icon does not prove that the extension is genuine, safe or authorised.

Preserve identity, version and installation route¶

Record the stable extension identifier, version, manifest, publisher, source, installation time, permissions, configuration and update history. Retain the relevant browser profile, policy and account-synchronisation records.

The extension may have been installed locally, by organisational policy, through another application or by synchronising a compromised browser account. That distinction identifies where persistence originated; the examined device may only have received a synced copy.

Move from permission to observed activity¶

Permissions can allow access to pages, forms, cookies, downloads or sessions, but do not prove every capability was exercised. Browser, network and account records can show actual collection, requests or changes.

An official extension can later be compromised or updated, so preserve the version that applied during the incident. Removal alters the profile and does not undo data already taken or account access already obtained; record both preservation and remediation actions.