The extension / Reference
The permissions it asks for
What Chrome and Edge say when Browser Rules is installed, what each permission is used for, and what the extension never does.
What your browser shows
When the extension is installed, Chrome and Edge list what it can do. These messages sound alarming, as they do for any extension that checks websites. Here's what each one means for Browser Rules.
| The browser says | What Browser Rules does with it |
|---|---|
| Read and change all your data on all websites | Dangerous downloads, websites and clipboard attacks can come from any website, so the checks run on every one. On a page, it looks only at what a policy needs: a download link that's clicked, text copied or pasted, the name and size of a file given to the website, and the page's address. Text is checked on the computer, not sent away to be checked. It doesn't change what a page shows, apart from your message. |
| Manage your downloads | To check each download before it's saved: it pauses the download, checks the file (inside ZIPs too), then saves it or blocks it. |
| Know your email address | To know who is using the browser, from the account signed in to it, so your policies for that person and their groups apply. The email goes only to your organisation's admin console, and only once the browser is enrolled. |
Each permission
| Permission | What it's used for |
|---|---|
| Access to all websites | To run the checks on every website, and to fetch a download again from the website it came from, to check what's inside. |
| Downloads | To pause each download, check it, and save the checked file or block it. |
| Blocking websites (declarativeNetRequest) | To stop a website your policies block before it loads, and show your message instead. |
| Page scripts (scripting) | To add the checks for clicked download links, the clipboard, pastes and uploads to each page, and to leave them off websites you exclude. |
| Reading requests (webRequest) | Only reading, never blocking or changing. When a page sends a form and gets a ZIP back, as SharePoint's download of several files does, it sends the same form again to check the ZIP; the form is kept in memory for a minute at most, never stored or sent. When someone gives a website a file, it notes for a few seconds which website received it, for the audit log. |
| Identity and email | To know who is using the browser, as above. |
| Storage | To keep your policies, the enrolment and the browser's own audit log on the computer, and to read the settings your device management gives it. |
| Offscreen document | To fetch and check downloads in the background, without opening tabs. |
| Alarms | To check for policy changes every few minutes, and to end a temporary pause on time. |
What it never does
- It never reads what people type, and never records keystrokes or mouse movements. It records a website visit only when one of your policies says to.
- It never uploads files. Downloads are checked on the computer; uploads are decided by the file's name and the website.
- It never runs code from the internet. Everything it runs is in the package from the Chrome Web Store; your policies arrive as plain data.
- Until the browser is enrolled, it sends nothing anywhere, and its audit log stays on the computer. Once enrolled, it sends your own admin console its check-ins (the browser, its version and who is using it) and audit events: what was blocked, warned about or recorded, in the detail your Privacy settings allow.
- Its data is never sold, or used for anything but your organisation's policies.
More on how data is protected: Security and the privacy policy.