Release notes

Settings in one place, and renaming your organisation

All settings opens one page with tabs: Organisation, Members, Privacy, Download limits and, for IT providers and their clients, IT provider/MSP. Privacy keeps its own link in the menu too.

• Owners can rename their organisation in Settings, Organisation. Browsers show the new name within a few minutes.
• Deleting an organisation lists only what it actually holds.
• Invitations are deleted 30 days after they expire or are accepted. The audit log still shows who was invited and who joined.
• Pages matched by their address, such as sign-in pages and advert clicks, are recorded without the part after "?". The Privacy help now says so.
• Our release notes are now on our website too, at browser-rules.com/release-notes.

IT providers and MSPs: manage your clients

If you look after Browser Rules for other businesses, you can now manage each client from your own sign-in.

• Tick IT provider/MSP in Settings, then create an organisation for each client from the organisation menu.
• Everyone in your organisation can work in your clients' organisations, with the role they have in yours.
• Clients, under Overview in the menu, lists your clients with their users and browsers. Open takes you to any of them.
• Each client keeps its own policies, users, audit log and plan, and its data is kept apart.
• A client sees who manages it. Once it has an owner of its own, it can take over its organisation.

Warnings websites can't get rid of

Browser Rules 0.9.0 makes your messages harder to get round, and records website audits as your Privacy settings say.

• Website audits follow Repeated events on the Privacy page, as blocks and warnings do. Before, a visit was recorded at most once a day.
• A website can't get rid of your message. If it removes it, Browser Rules puts it back. If it keeps removing it, the warning moves to Browser Rules' own page, where people can carry on or go back.
• Pages that rewrite themselves still have their downloads, uploads, pastes and clipboard checked.
• While a message shows, right-click and the developer tools keys do nothing. To turn developer tools off completely, use the DeveloperToolsAvailability browser policy.
• Line breaks in your messages show as you typed them, and a blank line starts a new paragraph.

Choose the emails we send you

Choose the emails we send you Choose your emails in Account, Notifications. Service emails, about changes to our sub-processors, terms or security, always come. Product updates and marketing come only if you tick them, and each has an unsubscribe link.

Download or delete your data

Account, Personal data: download a copy of your account's data, or delete your account. Settings, General (owners): download a copy of your organisation's data, or delete the organisation. Deleting your account never deletes an organisation. Its last owner hands it over, or deletes it, first.

Audit that only records, and less sent to the console

Browser Rules 0.8.0 makes Audit record without deciding, and sends the admin console less.

An Audit policy now records what it matches, and the policies below it decide. It can no longer let something past a policy below, including the default policies. To allow something and keep a record of it, put an Audit above an Allow. Copied text reaches the admin console only when Browser Rules' list of malicious commands matches it. Your own content lists record which pattern matched, never the text. Auditing every website records only the website, never the page.

Balanced privacy by default, and checks before you publish

The admin console now starts at the Balanced privacy level, and checks more before you publish.

• Balanced is the default privacy level: the user and the page, addresses without their query, and no clipboard text or pause reasons. To keep every detail, choose Full detail in Settings, Privacy.
• Review changes shows how many of the 1,000 website rules browsers can hold your policies use. Changes over that limit can't be saved.
• A policy that would audit every website, every upload or the clipboard on every website warns that it can fill the audit log, and asks first.

Paste policies, and Microsoft device code sign-in blocked

Browser Rules now checks the text users paste into websites, and blocks Microsoft's device code sign-in pages by default.

• Paste policies decide pasted and dropped text before the website gets it: block, warn or record.
• Only pastes of at least a set number of characters are checked, 500 for a new policy.
• Pasted text is never recorded, not even what a content list matched. Records give the website and the number of characters.
• All clipboard actions now covers pastes too.
• A new default policy blocks Microsoft's device code sign-in pages, and the short links to them, for work and personal accounts. Attackers send users a code to enter there, then take over the account, MFA included.
• Fixed: some ZIPs, such as some downloaded from SharePoint, start with a marker Browser Rules didn't expect. They're now checked, instead of blocked as not a ZIP.

Paste policies, device code sign-in blocked, and more

Paste policies: clipboard policies can now decide the text users paste into websites. Choose Pastes as the clipboard action.

• Only pastes of at least a number of characters are checked. Shorter pastes, such as a link or a sentence, are left alone. A new policy starts at 500.
• Block keeps the text from the website. Warn shows your message, and can keep the paste back until the user confirms and pastes again.
• A content list can check the pasted text, so a policy acts on what's pasted, at any length.
• The audit log records the website and how many characters were pasted. It never records the text, whatever your Privacy settings.
• All clipboard actions now includes pastes.
• Add policy offers Warn before pasting into AI assistants, and Warn before long pastes into Google AI Mode. For uploads, it offers Warn before uploading files to Google Search.

Microsoft device code sign-in: a new default policy blocks the pages attackers use to take over Microsoft 365 accounts with a code. The user signs in on Microsoft's real page, MFA included, and the attacker gets the account.

• It's on for every organisation. Find it at the bottom of Protection, Websites.
• To let IT use device code sign-in, Add policy offers Allow Microsoft device code sign-in for a group. For a warning instead, it offers Warn before Microsoft device code sign-in.
• Library, Website lists shows the pages it covers. Browser Rules keeps the list up to date.
• With Microsoft 365 Business Premium, or Entra ID P1, also block device code flow with Conditional Access. It covers every device and app.

Also improved:

• Block dangerous file types now says what it does with ZIPs. They're opened and checked, and blocked only if a file inside is dangerous, they hold another ZIP, or they can't be checked.
• The enrolment guide names each method by what you use: Intune, Group Policy, Google Admin, Mac device management and Linux policy files.
• On Browsers, the key is now labelled Enrolment key.
• Owners see a red banner when more users are enrolled than their plan allows. Everyone stays protected.

Paste policies and the device code default need extension 0.7.0. Earlier versions skip them.

Upload policies, and SharePoint ZIPs checked inside

Browser Rules now checks the files users upload, as they choose, drop or paste them.

• Upload policies block, warn about or record each file, by website and file type.
• When several files are given at once, the strictest decision applies to all of them.
• A blocked file never reaches the website. After a warning, users confirm, then choose the file again.
• Record every upload, when turned on, records each file's name, size and website. It never records the content.
• A ZIP a website sends in reply to a form, such as SharePoint's download of several files, is now checked inside. Before, it couldn't be checked, so it was blocked unless a policy allowed it.
• When no download policy is on, clicks on download links are left to the browser.
• When no upload policy is on and uploads aren't recorded, file pickers, drops and pastes are left to the browser.
• Record every download now only records. It never pauses or fetches a download.
• Fixed: an audit log entry could be lost when two were written at the same moment.

0.6.0 adds one permission, to see which website a form or a file is sent to. Chrome shows no new warning for it.

A new Overview, Privacy page, and Users and groups

• Overview: warnings come first, then the last 7 days' activity, a tile for each control, and your browsers and users.
• Browsers and users shows how many browsers have the latest policy.
• Privacy: choose a level, from Most private to Full detail, or choose each setting yourself.
• An example on the Privacy page shows what the admin console receives. The page also shows how long your audit log keeps events.
• Users and groups are now one page, with a tab for each.
• Deleting a user now deletes their record and email. Their past audit events stay, shown as Deleted user.
• Uploads now sits under Downloads in the menu.

Upload policies

Upload policies decide which files users can upload, by website and file type. Find them under Protection, Uploads.

• Block keeps the file from the website.
• Warn shows a message first. It can also keep the file back until the user confirms and chooses it again.
• Audit records each matching file in the audit log. It records the name, size and website, never the content.
• Add policy offers ready-made rules, such as Block uploads to personal file sharing and Warn before uploading to AI assistants.
• Privacy, Record every upload records every file users upload, not only those a policy matches. It's off by default.
• The audit log shows uploads as Upload, with the file and the website.

Upload policies need extension 0.6.0. Earlier versions ignore them.

A new look for every message

Every message users see now shares one design, with your organisation's logo and colours.

• Each message names the file or website, and its buttons say what they do, such as Don't download, Go back or Don't copy.
• Every message greys the page until it's answered or closed. The small download panel doesn't.
• "Protected by Browser Rules" is shown below each message.
• Warnings use the standard message's own warning wording.
• A new presentation: Centred banner.
• Files a web page makes itself, such as GitHub's download button saves, are decided by name like other downloads. They were always blocked. A .zip a page makes can't be checked, so it's blocked unless an Allow policy covers that website.
• A ZIP whose policy doesn't check inside is decided without being downloaded twice. This lets an Allow policy cover SharePoint and OneDrive downloads of several files.
• The download panel stays in the corner, in your organisation's look. Saved downloads show nothing.
• Clipboard messages no longer show the command text on the page. The audit log keeps it, as your Privacy settings allow.
• A warning on users' own copies that needs an answer now waits for it before copying.
• The popup has Sync now for a connected browser.
• An optional deviceName browser policy names each device on the Browsers page.
• The toolbar icon no longer changes. Results are in the popup.

Fixed:

• Copy warnings shown over the page no longer stop the copy.
• A ZIP named only by the website is now checked inside.
• A link to a web page, such as GitHub's preview of a .zip, opens the page instead of saving a broken file.
• Links a website refuses to check, such as GitHub's "too many requests", open as normal pages.
• GitHub's Raw button saves files under their real names.
• A blocked file the browser finished saving first is now deleted more reliably. If it can't be deleted, users are told to delete it.
• Audit log events for files saved before they could be checked now include the file name.

Messages: your logo, a standard message and previews

Library, Message templates is now Library, Messages. Set how every message looks and reads there.

• Default style: your organisation's name, logo and colours, on every message and the download panel. Upload a PNG, JPEG or WebP. It's shown up to 200 by 50 pixels.
• The standard message: used by the default policies, by policies with no message chosen, and for blocks no policy decided. It has its own wording for blocks and for warnings. Edit it, or put the built-in wording back.
• Templates are used only by the policies that choose them.
• Previews show each message as users see it, as a block or a warning, in each presentation.
• A new presentation: Centred banner.
• The policy editor says when users see no message (Allow and Audit).
• The default policies are now named Block dangerous file types and Block malicious commands.
• Add policy offers Allow SharePoint and OneDrive multi-file downloads. SharePoint and OneDrive send several files as one ZIP that can't be checked, so it's blocked by default. This policy lets those ZIPs through. It covers every organisation's SharePoint and OneDrive, not only yours.

Your logo, Centred banner, the standard message's warning wording and the SharePoint policy need extension 0.5.0. Earlier versions show the Browser Rules icon, a centred overlay and their own warning wording.

Extension 0.4.1: device names, a quieter download panel and safer copying

• Device names: set the optional deviceName policy, and each browser shows its computer's name in the console.
• Downloads that are simply saved show nothing extra; the browser already shows them. Allow and Audit now look the same to users.
• The download panel sits in the corner without blocking the page. It shows only while a ZIP takes a moment to check.
• The download panel and every message use your organisation's name and colours.
• A download blocked for technical reasons, such as one that couldn't be checked, shows your default message with the reason.
• A copy warning that needs acknowledgement now holds the copy until the user answers. "Don't copy" copies nothing.
• A copy warning without acknowledgement now lets the copy through. In 0.3.0 the text could fail to copy.
• Copy warnings name the list that matched, never the command itself.
• Seven new techniques caught in the extension's own Malicious commands list, used before a browser enrols.
• A ZIP named only by the server is now checked inside.
• A file the browser saved before it could be stopped is deleted; if it can't be, users are told to delete it.
• The popup has Sync now for enrolled browsers. The toolbar icon no longer changes.
• A link ending .zip that leads to a web page, such as a preview on GitHub, now opens the page instead of downloading it.

Removing users, hidden browsers and device names

• Remove users: People, Users. They leave their groups straight away and stop counting towards your plan. If their browser is still enrolled, they re-appear at its next check-in. Show "Removed users" to find them again, with Add back.
• Hidden browsers: browsers not seen for 90 days drop out of the Browsers page and its counts. They reappear if they check in again. The Hidden filter finds them.
• Device names: your device management can give each browser its computer's name, with the optional deviceName policy. It shows on the Browsers page, the Users page and in the audit log. Needs extension 0.4.0; see Name devices in the help.
• Package installs: a new built-in list, Package install commands, with two rules in Add policy to warn before users copy one (from a website's Copy button, or their own copy).
• Malicious commands: seven new techniques caught, including fake installers and ssh, msbuild and ftp tricks. Enrolled browsers get them within minutes.
• "Warn before copying install commands" is now "Warn when users copy a risky command", with a message that fits everything it catches.
• Message templates: Reset to defaults puts the standard Browser Rules look back.
• Fixed: the Save button in edit panels stays on screen on phones and tablets.

Browser Rules 0.3.0

Downloads are decided by file name, and policies are simpler: a policy lists file types, and adding zip to the list is what makes it apply to ZIP files, checked inside or as a whole.

• One default download policy, Dangerous file types, which now covers ZIP files: a ZIP that can't be checked, or a ZIP inside a ZIP, is blocked too. To allow either from a website you trust, add a policy for that website with zip on its list.
• Far more real-world ZIPs can be checked, and the reason a ZIP can't be is said plainly, such as "The ZIP is password-protected."
• The dangerous file types list covers macOS and Linux as well as Windows.
• Website lists: shared lists of websites for policies, including ones Browser Rules keeps up to date (AI assistants, file sharing, webmail, social media).
• The default policies' lists are kept up to date by the console, so new threats are covered without an extension update.
• Eight more ClickFix techniques are blocked on the clipboard.
• Block and warning messages can include links, such as to your own help page.
• Fixed: after many downloads in one browser session, a download could fail with "Session storage quota bytes exceeded".
• Fixed: a download that failed while being saved was recorded with the earlier decision instead of the failure.

Policies made simpler and a Rule Library

Download policies are simpler. A policy lists file types, and adding zip to the list is what makes it apply to ZIP files: tick Check inside .zip files to check what's inside, or leave it unticked to match every ZIP as a whole. The separate ZIP options have gone.

• One default download policy, Dangerous file types, which now covers ZIP files: a ZIP that can't be checked, or a ZIP inside a ZIP, is blocked too. The list also covers macOS and Linux file types.
• Rule Library: Add policy offers common rules to start from, such as allowing all ZIPs from a website you trust or blocking AI assistants. Pick one, fill in the website and who it's for, and save.
• The policy editor shows what a policy does in a sentence, and the policies list shows each policy's file types, websites and how it treats ZIPs, the default included.
• Browsers: Restore reverses a revocation. The browser downloads the latest policies at its next check-in.
• Privacy: Record every download, off by default, and Record repeated events, to choose how often a repeated block on one website is recorded.
• General settings keep only the limits: what to check is set by policies.
• Intune: the enrolment guide installs the extension with a configuration profile, with a script only for the enrolment key.

Review changes before they're published

Changes now wait until you publish them, so nothing reaches browsers by accident.

• Unpublished changes: every change in the console waits until it's reviewed. A bar on every page shows there are unpublished changes, and Review changes lists each one, marking any that weaken protection, before you publish or discard them.
• Website lists: block or warn about whole categories, such as AI assistants, personal file sharing, webmail and social media, kept up to date by Browser Rules.
• Links in messages: add a link to your own guidance in a block or warning message, for example [Our download policy](https://intranet.example.com/downloads).
• A clearer audit log: open any event for its full details, filter by when something happened, and plainer wording throughout.
• Private windows: the enrolment guide explains how to require the extension in Incognito and InPrivate windows, or turn them off.
• Easier on a phone, with a menu for the navigation.
• Many wording improvements and fixes.

Some of these, including links in messages and ZIPs inside ZIPs as a policy option, need the next version of the extension (0.2.0), which follows once 0.1.0 is approved.

Browser Rules 0.1.0

The first version of the Browser Rules extension, for Chrome and Edge.

• Blocks dangerous downloads, including inside ZIP files.
• Applies your organisation's website policies.
• Stops websites putting malicious commands on the clipboard (ClickFix).

Install it from the Chrome Web Store and enrol your browsers with the enrolment guide. You manage everything from the admin console.

The Browser Rules console is here

Manage Browser Rules for your whole organisation from one place.

• Policies for downloads, websites and the clipboard, checked from the top, with built-in default policies for dangerous file types, ZIPs inside ZIPs and malicious commands people are tricked into pasting.
• Policies for everyone, for selected users or for user groups.
• Messages and warnings in your own words, brand and colours.
• An audit log of every block, warning and change, with privacy settings for what browsers send.
• An enrolment guide for Intune, Group Policy, the Google Admin console, macOS and Linux.