Chrome Browser Extension Management

There are two approaches to distributing the the PixieBrix Browser Extension within your organization:

Refer to the Google documentation for how your organization manages access to Chrome Browser Extensions:

You can use the Google Admin Console to install the PixieBrix Chrome Browser Extension on all managed accounts, or allow installing it if extensions are blocked by default. On the Google Admin console, the page used for configuring extensions is under Devices > Chrome > Apps & Extensions > User & Browsers

Select the Organization Unit to apply the policy

Click the yellow + button in the bottom right to add an extension, and click “Add Chrome App or Extension by ID”:

Enter the PixieBrix Chrome Web Store Extension ID mpjjildhmpddojocokjkgmlkkkfjnepo and click Save to add PixieBrix

Click the Installation Policy to change the default installation policy:

After saving, the extension will be installed for any accounts set to have it installed to if you chose to Force install.

By default, on installation, the PixieBrix extension prompts the team member to link the extension to a PixieBrix account. However, if the team member closes the extension, PixieBrix will not prompt them to link the extension again.

To require a team member to link the extension to a PixieBrix account, PixieBrix supports using Chrome’s Managed Policy feature to associate an extension installed with your organization. As part of the PixieBrix heartbeat every 5min., PixieBrix will check if it’s unlinked and prompt the user to link their extension.

To verify that Chrome is reading the managed policy, navigate to chrome://policy in your Chrome browser

If you have the PixieBrix extension installed (v1.5.10 or higher), you’ll see the policy value you’ve provided. For example:

Windows

On Window, use the registry to set the managedOrganizationId property for the extension:

The type of the managedOrganizationId key should be REG_SZ (a string) and provide the UUID for your organization.

The pre-approve hostnames for modification/API calls, use the runtime_allowed_hosts setting. See Configure ExtensionSettings policy for more information.

Providing origins allows PixieBrix to activate deployments targeting those hosts without prompting the team member to accept permissions.

The setting supports supports wildcard sub-domains, but not paths. For example:

To pin a force install the PixieBrix Browser Extension to a current/historic version, see the Pin Chrome app or extension updates documentation

See our Extension permissions section of our Privacy Policy

CRXcavator is a tool from Duo Security to automatically assess the risk of Browser Extensions. As an automated scanning tool, its results need to be put into context.

Relative Risk Scores of other Extensions

The PixieBrix extension is a leader compared to other enterprise automation extensions:

Permissions

See the Extension permissions section of our Privacy Policy for a full explanation of what permissions our extension requests and why.

The Chrome Web Store team reviews the extension with respect to the stated purpose of each permission.

The main permissions risks flagged by CRXcavator are:

Content Security Policy (CSP)

The main CSP risks included in the CRXCavator score are:

External Communications