Each major browser can run a default deny extension posture, but the policy names differ. Chrome and Firefox use an ExtensionSettings policy with a wildcard entry. Edge supports that too, and also offers blocklist and allowlist policies. The behavior for already installed extensions differs, so test it.
Why compare them
Developer teams rarely use one browser. A policy written for one is often copied to another with assumptions that do not hold. The table below lists what each vendor's documentation says.
| Question | Chrome | Edge | Firefox |
|---|---|---|---|
| Wildcard key | Asterisk in ExtensionSettings | Asterisk in ExtensionInstallBlocklist or ExtensionSettings | Asterisk in ExtensionSettings |
| Block value | installation_mode blocked | Blocklist entry | installation_mode blocked |
| Allow exceptions | Per ID entry with allowed | ExtensionInstallAllowlist | Per ID entry with allowed |
| Silent install | force_installed or normal_installed | ExtensionInstallForcelist | force_installed or normal_installed |
| Remove existing | removed mode | Disables, does not uninstall | blocked removes it |
Chrome
Google's administrator help describes ExtensionSettings fields that apply per extension ID or to every extension with an asterisk. Modes are allowed, blocked, force_installed, normal_installed and removed. The removed mode blocks installation and removes the extension if it was installed before. The two installed modes require an update_url and cannot be used with the asterisk.
Edge
Microsoft documents separate policies. Type an asterisk into the blocklist policy to stop all installs, then add the allow policy for specific IDs. It also supports ExtensionSettings with the same style of JSON. A blocklisted extension that is already installed is disabled and cannot be re-enabled by the user, but it stays on disk. The force list overrides the blocklist.
Firefox
Mozilla's reference says the asterisk entry accepts only allowed or blocked. Per extension entries can use force_installed and normal_installed. Blocked removes an installed copy.
Where teams get caught
Three differences cause most of the surprises.
- Removal. Edge disables, Chrome has a dedicated removed mode, and Firefox removes on blocked. If you need data gone, check each browser.
- Install requirements. Installed modes need an update or install URL in Chrome and, for many cases, in Firefox. Forgetting it means the policy silently does less than you think.
- Where the asterisk is allowed. Firefox restricts what the asterisk can do, while Chrome refuses installed modes with it.
A rule of thumb
Write the intent once in plain words: block all, allow these named IDs, require these two, remove these known bad ones. Then translate it per browser and test each translation on a clean profile and on a profile with old extensions.
Safeguard note
Safeguard provides a browser extension for Chrome and Edge, an add-on for Firefox and an extension for Safari, plus a free scan at gold.safeguard.sh/scan. Browser policy itself stays in each browser's management tools.
Quick check
Which browser disables rather than removes a blocked extension?
Microsoft's documentation says Edge disables an already installed blocklisted extension and does not uninstall it.
Can I use force_installed with the asterisk in Chrome?
No. Google's help says force_installed and normal_installed need an update_url and cannot be used with the asterisk.
Sources
- Manage Chrome extensions, Chrome Enterprise help
- Use group policies to manage Microsoft Edge extensions, Microsoft Learn
- ExtensionSettings policy, Firefox administrator reference
Last reviewed: 19 October 2026.
