Browsers and browser extensions

Web browsers, and the extensions installed in them, are software in scope for Cyber Essentials. They must be supported, and their critical and high-risk security updates installed within 14 days of release. Because Chrome, Edge and Firefox ship security fixes every few weeks or more often, the practical answer is automatic updates plus regular restarts, so the update actually takes effect.

Why browsers need extra attention

The NCSC's definition of software includes applications and extensions. The question set asks you to list every browser installed on your devices, with its version, so the assessor can check it is supported (A6.2.1). It also says the 14-day rule for applications covers their associated files and extensions (A6.5).

Browsers update often:

• Google Chrome moved to weekly stable security updates between its major releases in 2023, to shorten the gap between a fix being public and reaching users.
• Microsoft Edge follows the Chromium release schedule. Since Edge 152, Microsoft ships a new major version every 2 weeks, with an Extended Stable option on an 8-week cycle for managed organisations.
• Mozilla Firefox publishes security advisories with each release, including for its Extended Support Release (ESR).
• Safari updates come with macOS, or as separate Safari releases on older supported macOS versions. See Apple devices and updates.

Most new major browser versions include high or critical security fixes. In practice, a browser more than 14 days behind its latest release is likely to be out of date.

The restart problem

Chrome, Edge and Firefox download updates automatically, but the new version only runs after the browser restarts. A browser left open for weeks can sit on an old version while showing an "update available" prompt. For managed devices:

• set a relaunch policy that prompts users and then forces a restart within a few days (Chrome and Edge both have relaunch notification policies)
• check the reported browser versions in your device management console
• do not disable the browser's own updater

Supported channels

Use the vendor's normal stable channel, or a supported long-term channel:

• Firefox ESR is supported while Mozilla issues security releases for that ESR version. Keep it on the latest ESR point release.
• Edge Extended Stable is supported, but is only available in managed environments. Keep it on the latest release in that channel.
• Beta, Dev and Canary channels are pre-release. Avoid them on in-scope devices.

Internet Explorer 11 is retired and unsupported. If it is still present, disable or remove it.

Remove browsers you do not use

Every installed browser must be kept up to date, even if nobody uses it. The secure configuration control also requires you to remove software you do not need. If staff use Edge and Chrome, remove Firefox, Opera or any old portable browsers from devices.

Extensions

Extensions run inside the browser with access to the pages you visit, so treat them like any other application:

1. Allow only approved extensions. Chrome and Edge support allow lists and block lists by policy. Firefox can do the same through its enterprise policies.
2. Keep the list short. Remove extensions nobody needs.
3. Remove abandoned extensions. An extension that its developer no longer maintains is unsupported software.
4. Let extensions auto-update. Store-installed extensions update automatically by default.

On personal devices used for work, set out in your BYOD policy which browsers and extensions are allowed, or limit work access to managed apps.

In your answers

In A6.2.1, list each browser and the version on the day you submit, and say how it updates. For example: "Microsoft Edge Stable, auto-update on, forced relaunch within 3 days by Intune policy. Google Chrome Stable on 4 developer laptops, same policy. Safari on Macs, updated with macOS." In the malware section, browser protections such as Microsoft Defender SmartScreen or Google Safe Browsing can help meet the rule on blocking malicious websites.

What assessors typically query

• No versions given.
• Several browsers installed with no reason.
• Browser versions well behind the current release on the day of submission.
• No mention of extensions.

Read more in the 14-day update rule and the supported software rule.