CIS Controls CIS-9.4

Browser extension allowlists, denylists, installation restrictions, and removal of unauthorized extensions directly prevent malicious browser extensions from establishing persistence or abusing inherited browser permissions.

Disabling unauthorized Outlook add-ins prevents those add-ins from automatically loading code when the email client starts. This directly reduces persistence through email-client add-on functionality.

This technique includes browser extensions, which are directly addressed by the safeguard.

Restricting email-client add-ins mitigates the add-in portion of this parent technique.

Malicious browser extensions may access browser cookies and session information. Restricting extensions removes one important cookie-theft path.

Malicious extensions may access credentials stored in browsers. Extension restrictions reduce that attack surface, but malware already executing with access to the browser profile may still extract stored credentials.

Removing unnecessary or vulnerable browser plug-ins reduces components that a malicious website can enumerate and exploit during a drive-by attack.

Uninstalling unnecessary browser or email-client plug-ins removes potential client-side exploitation targets.