Browser Extension Forced Install via Policy Page

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•6

This rule detects attempts to force the installation of browser extensions via a policy page. It specifically looks for the string "ExtensionInstallForcelist" in HTTP response data flowing to the client, indicating a mechanism used to programmatically install extensions, often abused by malware or unwanted programs to maintain persistence or inject malicious functionality into browsers.