A policy-installed extension is a browser add-on deployed by administrative policy instead of by an individual user. In managed environments, IT or security teams can push these extensions centrally, which makes them appear trusted and can give them broad access to browser features and settings.
In cyber security, this matters because “installed by policy” does not automatically mean “safe.” Attackers who gain control of management tools, group policy, or enterprise software distribution can abuse policy-installed extensions for persistence, tracking, search hijacking, or unwanted configuration changes. Defenders watch these extensions closely, use allowlists, restrict permissions, and audit who can deploy them. Strong browser controls help ensure that administrative power cannot silently override user settings or weaken the browser’s security posture.