A legacy extension is an older browser add-on that was built for a previous platform policy, API set, or manifest version. It may still be installed on user devices even after the browser vendor changes store rules or drops support for that older format. In practical terms, the extension may keep working for a time, stop updating, or become unavailable for new installs while existing copies remain in place.
Legacy extensions matter because browser add-ons run inside a trusted user context and can read, change, or relay web content. Security teams treat them as part of the attack surface: an outdated extension can contain unpatched bugs, weak permissions, or code that no longer receives review. Defenders look for them during software inventories, browser policy audits, and endpoint hardening, while attackers may abuse forgotten add-ons or target them through supply-chain compromise and malicious updates.