Can you tell users why an extension install was blocked?

Yes. Chrome and Firefox support a blocked_install_message field in their ExtensionSettings policy. Chrome adds up to 1,000 characters of your text to the Chrome Web Store error. Firefox appends your string to its standard error. Use it to point people to a request path.

Why the message matters

A default deny extension policy only works if people can live with it. A bare error that says an install was blocked by the administrator sends developers to search for a workaround. A short note that says where to ask turns the block into a process.

Security controls that feel like a wall get routed around. Controls that come with a clear next step get used.

What the vendors document

Google's help describes blocked_install_message as custom text, up to 1,000 characters, added to the error shown in the Chrome Web Store when an install is blocked.

Mozilla's reference says the string is appended to Firefox's standard error message, and calls out the help desk use. It is valid in the asterisk entry and in per extension entries.

I did not find a matching field in the Edge extension documentation I reviewed, so check Microsoft's current policy list before assuming one exists.

What a good message says

Keep it short and concrete. Four elements cover it.

1. What happened: this extension is not on the approved list.
2. Why, in one phrase: we review extensions that can read page content.
3. What to do: where to submit a request, and the usual turnaround.
4. What to do meanwhile: a link to the approved alternatives.

Here is an example for a Firefox policy file.

{
  "policies": {
    "ExtensionSettings": {
      "*": {
        "installation_mode": "blocked",
        "blocked_install_message": "Not on the approved list. Request a review at the IT portal, usually answered within two working days."
      }
    }
  }
}

Replace the wording and the turnaround with what your team actually delivers. Do not promise a speed you cannot keep.

What to avoid

Do not put sensitive information in the message. It is shown to anyone who hits the block, and policy text can be read by users on their machines. Skip internal hostnames, ticket queue names that reveal your tooling, and anything you would not put on a poster.

Do not blame. People trying to install a color picker are not attackers.

Keep the request path real

A message is only as good as the process behind it. Decide who answers, how fast, and what the review looks at. Our checklist for approving a browser extension is a starting point, and the approve, restrict or reject decision guide helps with the outcome. Track how many requests you receive and how many you approve. A very low approval rate suggests your criteria are too tight. A rate near one hundred percent suggests the review is a formality.

Safeguard note

Safeguard offers browser extensions for Chrome, Edge, Firefox and Safari, and a free scan at gold.safeguard.sh/scan. Your block message is set in your browser policy.

Quick check

Sources

• Manage Chrome extensions, Chrome Enterprise help
• ExtensionSettings policy, Firefox administrator reference

Last reviewed: 19 October 2026.