Is Browser Security Plus safe?
We analyzed Browser Security Plus version 3.2.11's actual code and gave it a 42/100 trust score. This is a powerful enterprise-monitoring extension with…
Bottom line
This is a powerful enterprise-monitoring extension with broad access, sensitive collection, and a website-to-privileged-action weakness.
What it can access
It can monitor all websites, browser activity, transfers, entered enterprise emails, and settings, then communicate with computer software; this is powerful access even for enterprise management.[Q1][Q3][Q4][Q19]
Security weaknesses
A webpage can forge a message that may make the extension navigate another tab or add false audit data, creating a concrete privilege-boundary weakness.[Q21]
Signs of misuse
The package shows active collection of browsing history, enterprise email entries, page activity, and transfer details for delivery to its companion software.[Q3][Q6][Q12][Q15]
Code findings
What access does this extension ask for, and does that access make sense for what it claims to do?
It has all-site access plus management, native messaging, webRequest, downloads, tabs, scripting, privacy, content-settings and navigation permissions.
Loads four content-script groups on all URLs/all frames and declares the broad management and enforcement permissions. — manifest.json:21-75
Which websites can it run on, and can it read or change what appears on those pages?
Policy-directed classification can extract a page's title, metadata and visible text and send it to the local native host.
A scrappageandignore decision from the native host triggers data-extractor injection. — js/routingLogic.js:185-206
Returns normalized page text, title, metadata and URL. — js/data-extractor.js:149-220
Sends the extracted title, description and text through postDOMContent. — js/routingLogic.js:447-460
Can it see sensitive information you type, such as passwords, payment details, messages, or form entries?
It conditionally reads enterprise email addresses from form fields and PII patterns from text entry; raw enterprise emails are reported, while other PII reports contain only type and field metadata.
Enables capture only when the native policy supplies enterprise domains. — js/emailCapture.js:23-37
Reports matching email addresses with page and field metadata. — js/emailCapture.js:77-118
Locally detects/redacts PII and reports only the detected type/action and surrounding metadata. — js/genaiPiiBlocker.js:428-502
Can it access private browser data such as cookies, signed-in sessions, browsing history, bookmarks, or downloads?
It audits installed extensions, browser privacy/content settings and current web activity through the native host.
Collects names, versions, permissions, host permissions and install state for every extension. — js/routingLogic.js:272-300
Reads password, autofill, safe-browsing, cookie, referrer and content-setting states. — js/browserSettings.js:23-161
Posts extension inventory and browser settings to the native host. — js/nativePort.js:299-335
Can it access anything else on your device, such as files, location, camera, microphone, clipboard, or installed applications?
It monitors file uploads and downloads, reports names/sizes/types/URLs, and can cancel transfers under policy; it does not upload file contents in the traced path.
Builds upload records from filename, size, modified time, MIME and page URL; MIME sniffing yields a type rather than transmitting raw bytes. — js/uploadmanager.js:650-690
Sends upload metadata and page URL to the native host. — js/nativePort.js:388-408
Reports Chrome download metadata to the native host. — js/downloadManager.js:11-76
Does it send information outside your browser? If so, what information is sent, where does it go, and why?
It sends monitoring and enforcement records to the local native-messaging host; transmission from that separate host to a remote service is not shown by this package.
Connects to the fixed native host com.manageengine.browserrouter. — js/nativePort.js:53-62
Batches website, transfer, extension and email events through that native port. — js/eventQueue.js:706-734
Posts raw captured enterprise emails and GenAI violation metadata to the native host. — js/nativePort.js:413-442
Does it download or run code, settings, or instructions supplied by a remote server?
The native host supplies live filtering, history, metering, upload, phishing, email-domain, GenAI and event-reporting policies.
PolicyRefresh updates feature flags, ruleJSON, GenAI domains/mode and enterprise email domains. — js/nativePort.js:84-178
Native policy also enables and configures the event queue. — js/nativePort.js:191-226
Can it take actions without a clear user request, such as opening pages, redirecting searches, downloading files, or sending requests?
It automatically evaluates navigations, downloads and configured field/upload activity; enforcement does not require a per-action user click.
Registers main-frame request, navigation and extension-management listeners at startup. — js/routingLogic.js:303-353
When configured, attaches automatic input, paste, submit and mutation listeners. — js/emailCapture.js:234-261
Registers download lifecycle listeners after native connection. — js/downloadManager.js:174-181
Can it change important browser settings, including your proxy, search engine, homepage, privacy settings, or other extensions?
It reads browser privacy/content settings and native policy can set startup URLs or replace new-tab navigation; it does not directly call privacy-setting setters.
Audits privacy and content-setting values. — js/browserSettings.js:23-161
Native instructions can open startup URLs and redirect new-tab pages. — js/nativePort.js:528-576
Is any important behavior difficult to inspect because the code is hidden, heavily obfuscated, dynamically generated, or supplied by third parties?
No evidence of this behavior was found in the reviewed package.
Imports named readable modules plus the identified zlabs phishing library and packaged data. — js/service-worker.js:33-42
Contains a large explicit vocabulary data object. — js/data.js:1
Does it use eval(), new Function(), or string-based timers to turn text into executable code?
No evidence of this behavior was found in the reviewed package.
Loads a fixed list of packaged scripts with importScripts. — js/service-worker.js:33
Declares no custom extension CSP or remotely loaded script. — manifest.json:1-88
Does it track the websites, pages, searches, or links you visit?
It records full successful main-frame URLs and timestamps, and optional web metering reports active-tab focus and repeated activity heartbeats.
Builds a history record containing full URL, domain, timestamp, tab ID and sometimes response IP/status, then posts it to native messaging. — js/historyCollector.js:47-77
Registers main-frame response tracking and exposes a visible toolbar title when policy enables history tracking. — js/historyCollector.js:113-145
Posts active-tab heartbeats every ten seconds when metering is enabled. — js/webMetering.js:118-147
Does it create a persistent ID or browser fingerprint to recognize you?
It produces organization audit telemetry for websites, transfers, extensions, captured enterprise email and security findings; no advertising identifier was found.
Defines the enterprise OCSF event classes and local-native transport. — js/eventQueue.js:1-18
Adds process metadata, batches enabled events and sends them to the native host. — js/eventQueue.js:669-734
Does it send cookies, session details, authentication data, or page contents elsewhere?
No evidence of this behavior was found in the reviewed package.
Does not request cookies permission. — manifest.json:62-75
Classifies login-related fields and skips PII processing for that context. — js/genaiPiiBlocker.js:168-196
Does it record typing, form entries, clipboard contents, or screenshots?
Under policy it monitors text, hidden, textarea and contenteditable fields plus paste and submit events for enterprise emails; GenAI policy also inspects entered text for PII, but password inputs are not selected.
Reads field values and pasted text, filtering results to configured enterprise-domain email addresses. — js/emailCapture.js:103-171
Scans existing/dynamic fields and form submissions and attaches input/change/paste listeners. — js/emailCapture.js:174-261
Attaches text-input, paste, Enter and beforeinput handlers only when GenAI policy/domain gating enables it. — js/genaiPiiBlocker.js:622-646
Can a website or remote server send commands that make the extension take actions?
No evidence of this behavior was found in the reviewed package.
Accepts policy and feature-control messages from the named native host. — js/nativePort.js:84-178
Native responses can close, remove or redirect tabs and request page inspection. — js/routingLogic.js:144-207
Native messages can set startup and new-tab destinations. — js/nativePort.js:528-576
Does it alter links, referral codes, advertisements, shopping carts, or search results?
No evidence of this behavior was found in the reviewed package.
Injects upload/download restriction UI into pages. — js/contentScript.js:164-282
Replaces detected PII with asterisks and shows a block warning in block mode. — js/genaiPiiBlocker.js:449-498
Monkey-patches file and directory pickers and returns empty/null when policy blocks them. — js/filepicker.js:1-89
Does it redirect or modify web traffic, request headers, downloads, or proxy settings?
It observes main-frame requests, sends URLs for policy decisions, can redirect or close tabs, and can cancel, remove and erase downloads.
Sends each eligible main-frame URL to the native router. — js/routingLogic.js:58-86
Applies native close/remove/custom redirect decisions. — js/routingLogic.js:144-175
Cancels, deletes and erases downloads when the native response says cancelDownload. — js/downloadManager.js:147-164
Can it communicate with software on the computer or services running on localhost?
It connects to the installed com.manageengine.browserrouter native application and can request a native-managed private browser session.
Opens and maintains the fixed native-messaging connection. — js/nativePort.js:53-76
Sends launchIncognitoSession and eligibility commands to the native host. — js/nativePort.js:660-696
Does it decode, decrypt, or unpack hidden data and then execute or inject it?
No evidence of this behavior was found in the reviewed package.
Applies native-supplied policy flags, rules, domains and event configuration. — js/nativePort.js:84-226
Executable modules are a fixed packaged import list. — js/service-worker.js:33
Content scripts are all packaged resources. — manifest.json:21-60
Can ordinary websites access privileged extension features through messaging or exposed files?
Any webpage can forge the report marker accepted by the content-script relay; a forged overridepage report reaches tabs.update with page-controlled tab ID and URL, although navigation requires guessing a valid tab ID.
Checks only event.source, a fixed page-controlled source string and the presence of report.Request before forwarding the full report. — js/contentScript.js:298-310
For overridepage, uses request.overriddenDetails.tabId and .url directly in tabs.update without binding them to sender.tab. — js/contentPort.js:139-143
The same bridge can also inject page-supplied EmailCaptured audit data into the native/event pipeline. — js/contentPort.js:103-110
Does suspicious behavior activate only for certain users, websites, dates, or remote settings?
No evidence of this behavior was found in the reviewed package.
PolicyRefresh controls monitoring and enforcement features. — js/nativePort.js:97-178
Adds/removes history listeners and changes the toolbar title to disclose tracking when the history flag changes. — js/historyCollector.js:122-145
Email capture stays disabled unless at least one enterprise domain is configured. — js/emailCapture.js:23-37
Does it perform hidden resource-intensive work, such as cryptocurrency mining?
No evidence of this behavior was found in the reviewed package.
Imports the packaged phishing classifier and management modules. — js/service-worker.js:33-42
Large data file is an explicit classifier vocabulary. — js/data.js:1
Does it change form fields or where a form sends its information?
No evidence of this behavior was found in the reviewed package.
The sensitive-field sink is local redaction plus a metadata violation report, not changing the form destination. — js/genaiPiiBlocker.js:428-502
Submit handling scans matching fields for enterprise email addresses without changing form actions. — js/emailCapture.js:186-200