Yes. Chrome and Firefox both have an allowed_types setting in ExtensionSettings that limits which kinds of add-on users can install, such as extension, theme or user script. It lives in the wildcard entry. Per extension entries can bypass it, and in Firefox it does nothing if the wildcard is already blocked.
What counts as a type
People say extension for everything, but the browsers distinguish several kinds of installable item.
| Browser | Types you can list |
|---|---|
| Chrome | extension, hosted_app, legacy_packaged_app, platform_app, theme, user_script |
| Firefox | dictionary, extension, locale, sitepermission, theme |
Google's help says the Chrome default is the wildcard only, which means any type. It lets you limit installs to any combination of the listed types. Mozilla's reference lists the five Firefox values.
Why restrict types at all
Two reasons come up most.
First, reduce surface area. If your approved list contains only extensions, there is no reason to leave user scripts or legacy app types open. Each type is another kind of code that can run in the browser, and fewer types means fewer things to review.
Second, simplify approval. A rule that says only the extension type is allowed is easier to explain than a long list of exceptions.
Do not overstate the benefit. A type limit does not make an allowed extension safe. It narrows what can be installed. It does not evaluate what an extension does.
How Firefox handles it
Mozilla's reference gives three details worth reading twice.
- allowed_types is only valid in the wildcard entry.
- It applies only when installation is otherwise allowed. If the wildcard has installation_mode blocked, allowed_types has no effect.
- Extensions with their own allowed, force_installed or normal_installed entry are not restricted by it.
So for a deny by default policy in Firefox, you do not need allowed_types. You block everything and allow named IDs. For a looser policy that allows extensions in general, allowed_types lets you stop themes and other kinds.
An example for a looser Firefox policy
{
"policies": {
"ExtensionSettings": {
"*": {
"installation_mode": "allowed",
"allowed_types": ["extension"]
}
}
}
}
This lets users install extensions but not themes, dictionaries or locales.
Test it on a real profile
After you apply the policy, try to install one item of each type you meant to block. Confirm the result in the browser's policy page. Then try an approved item with its own entry, because that is the exception path.
Where this fits in a program
Treat type limits as a small hardening step inside a broader extension policy. The bigger levers are the allowlist, permission blocks and an owner for each approved item. Our extension security policy template covers the full set.
Safeguard note
Safeguard offers extensions for Chrome, Edge, Firefox and Safari, and a free scan at gold.safeguard.sh/scan. Type limits are set in your browser's policy, not in Safeguard.
Quick check
Does allowed_types work if the Firefox wildcard is blocked?
No. Mozilla's reference says it has no effect when the wildcard entry has installation_mode blocked.
Can a named extension ignore the type limit?
In Firefox, yes. An extension with its own allowed, force_installed or normal_installed entry is not restricted by allowed_types.
Sources
- Manage Chrome extensions, Chrome Enterprise help
- ExtensionSettings policy, Firefox administrator reference
Last reviewed: 19 October 2026.
