Browser Hardening Guide: Extensions, Settings and Session Theft

The browser is where your logged-in sessions live. Email, banking, cloud storage, the company's administration console, the password manager extension: all of them authenticated, all of them sitting in one process, all of them reachable by anything that gains a foothold inside it.

That concentration is why browser compromise is worth so much and why the attacks that matter are not exploits against the browser itself. Modern browsers are heavily sandboxed and patched quickly. The realistic attacks go around that: an extension you installed voluntarily, a session cookie copied by malware, or a consent screen you clicked through.

This guide covers those, the settings that actually change outcomes, and the ones that are mostly ritual.

Scope: Phone Privacy Hardening owns mobile, What Is an Infostealer owns the malware that steals sessions, and Session Hijacking Explained owns the technique. This page owns the browser configuration.

Extensions

Start here, because this is where the risk concentrates and where you have full control.

An extension that requests "read and change all your data on all websites" can, without any further prompt: read every page you load including your bank and your email, modify what those pages display, read your cookies, capture what you type, and send all of it somewhere. That permission is requested by an enormous share of extensions, including ones with entirely legitimate reasons for it.

The specific problems:

Permission scope. Most extensions need far less than they ask for. An extension that works on one site can be restricted to that site.

Ownership changes. An extension with a long good history can be sold. The buyer inherits the install base and the update channel, and pushes a new version to everyone automatically. This has happened repeatedly and it is the reason a track record is weaker evidence than it feels.

Store review is not a guarantee. Malicious extensions reach official stores regularly, sometimes as clones of popular ones with names differing by a character.

Abandonment. An unmaintained extension accumulates unpatched flaws while continuing to hold its permissions.

The practical routine:

1. Open the extensions page and read the permission on each one. Chrome and Edge use chrome://extensions, Firefox uses about:addons.
2. Remove everything you do not actively use. Most people can get to fewer than five.
3. Restrict site access where the browser allows it: "on click" or "on specific sites" rather than "on all sites". This alone removes most of the exposure from an extension that later turns bad.
4. Check the publisher and the user count on anything you keep, and be suspicious of a recently published extension with a familiar name.
5. Re-audit twice a year, because the set drifts.

In a managed environment, an extension allowlist enforced by policy is the strongest available version of this and takes an afternoon to configure.

Session theft

This is the attack that has quietly replaced password theft as the thing to worry about.

When you log in, the site issues a session token and stores it in a cookie. Every later request presents the token. The multi-factor prompt happened during login, and it does not happen again for the life of the session.

Malware that copies the cookie store, or an extension that reads it, can replay that session elsewhere and be you, with no password and no second factor involved. Infostealer malware does exactly this at scale, collecting cookies, saved passwords, and password manager data, then selling the results in bulk. Many corporate intrusions now begin with a session bought from that market rather than with a phished password.

What helps:

• Do not run untrusted executables, which is where the malware comes from. Most infostealer infections trace to a cracked application, a fake installer, or a download prompted by a search advertisement.
• Sign out of sensitive accounts when finished, which invalidates the token server-side. Closing the tab does not.
• Use the account's session management page to review and revoke active sessions on email, banking and cloud accounts. Do this after any suspected compromise, because password changes alone do not always terminate existing sessions.
• Keep the operating system and browser current, since some cookie theft uses local vulnerabilities.
• Watch for the signs: sessions from unfamiliar locations, new mail forwarding rules, new OAuth grants.

Browser vendors are working on binding session credentials to the device so a copied cookie is useless elsewhere. That will help when it is widespread. It is not yet.

Consent phishing

A different attack with the same result and no malware at all.

You receive a link to authorise an application against your Google or Microsoft account. The consent screen is genuine, hosted by the real provider, on the real domain. It asks for permission to read your mail, access your files, or maintain access when you are not present. You approve, and the attacker now holds a token granting exactly those permissions.

No password was stolen. No MFA was bypassed, because none was involved. A password change does not revoke it.

Defenses:

• Read the permissions on consent screens. "Read, compose, send and permanently delete all your email" is a sentence worth stopping on.
• Be suspicious of applications you have never heard of asking for broad access, particularly with a generic name.
• Review connected applications periodically in your account security settings and remove anything unrecognised or unused.
• In an organisation, restrict user consent so that granting an application access to company data requires an administrator.

The settings that matter

Short list, because the long ones do not add much.

Automatic updates on, and restart the browser. This is the highest-value item here. Browser patches land frequently and only take effect after a restart, which people who keep 200 tabs open never perform. Restart weekly.

Block third-party cookies. Reduces cross-site tracking substantially with modest breakage.

HTTPS-only mode. Warns or refuses on plaintext connections. Nearly frictionless now.

Set site permissions to ask or block. Camera, microphone, location and notifications. Notification permission in particular is abused to deliver scam prompts long after you have left a site.

Enhanced or strict tracking protection in Firefox, or the equivalent privacy settings elsewhere.

Turn on Safe Browsing or SmartScreen. It blocks known phishing and malware pages, and the enhanced modes send more data to the vendor, which is the trade to consider.

Ask where to save downloads. Turns a silent drop into a decision, which catches drive-by downloads and the file that appears at the end of HTML Smuggling.

A sync passphrase if you sync, so the vendor holds ciphertext rather than your bookmarks, history and saved passwords.

Profile separation

The single highest-value structural change, and it costs nothing.

Run at least two profiles:

• Everyday. Browsing, reading, shopping. Extensions live here.
• Sensitive. Banking, administration consoles, work accounts. No extensions, minimal history, and nothing signed in that does not belong.

Profiles have separate cookies, storage, extensions and sessions. A malicious extension in the everyday profile cannot read the banking profile's pages or cookies. It also removes an entire class of cross-site problems, since the session that matters is not present in the window where you click unfamiliar links.

For work and personal, this has the additional benefit that a work device policy applies where it should and your personal accounts are not entangled with it.

Fingerprinting, honestly

Blocking cookies does not stop identification. Sites combine your user agent, screen size, timezone, language, fonts, canvas and audio rendering characteristics, and hardware details into a fingerprint that is frequently unique.

What you can do is limited, and it is worth being clear rather than optimistic:

• Firefox's resist fingerprinting setting standardises many of these signals and breaks some sites in the process.
• The Tor Browser is the serious answer, because every user presents the same fingerprint by design. It is slow and it is the only approach that genuinely works.
• Adding random extensions and unusual settings makes you more identifiable, not less, because rarity is what a fingerprint measures.

Treat fingerprinting as a reason to compartmentalise activity between profiles and browsers rather than as something a setting resolves.

Passwords and passkeys

• Use a dedicated password manager rather than the browser's, for the reasons in Password Managers Guide. If you use the browser's, set a sync passphrase and encrypt the device.
• Adopt passkeys where offered. They are phishing-resistant by construction, since the credential is bound to the site's origin and cannot be replayed against a lookalike domain. Passkeys Explained covers the mechanism.
• Do not let the browser store payment card details on a shared or work machine.

What is mostly ritual

Being honest about the low-value items saves effort for the high-value ones.

• Disabling JavaScript globally. Breaks the modern web and almost nobody sustains it.
• Long lists of about:config tweaks. Marginal gains, real breakage, and many make you more identifiable.
• Changing your user agent. Makes you stand out.
• Clearing cookies constantly while remaining signed in to the same accounts in the same browser.
• Stacking multiple content blockers. They conflict, and each one is another extension with broad permissions.

A ten-minute pass

1. Open the extensions page, read every permission, remove what you do not use, restrict the rest to specific sites.
2. Check for an update and restart the browser.
3. Block third-party cookies, enable HTTPS-only, set camera, microphone, location and notifications to ask or block.
4. Create a second profile for banking and administration, with no extensions.
5. Open your Google or Microsoft account security page, review connected applications and active sessions, and remove what you do not recognise.
6. Set a sync passphrase if you sync.

The verdict

Browser security is dominated by three things you control: what you install into it, whether a stolen session can be replayed, and whether the sensitive tabs share a profile with the everyday ones.

Fewer than five extensions, each restricted to the sites it needs. A separate profile with no extensions for anything that matters. Weekly restarts so patches apply. Those three do more than any configuration list, and they take one sitting to put in place.

Related guides

• What Is an Infostealer
• Session Hijacking Explained
• Password Managers Guide
• Passkeys Explained
• Phone Privacy Hardening