It depends on the browser and the setting. In Edge, a blocklisted extension that is already installed is disabled but not uninstalled. In Firefox, the blocked mode removes an installed extension. In Chrome, blocked prevents installs, and the separate removed mode also removes an existing copy.
Why the difference matters
Suppose a malicious extension is found on your developer laptops and you add it to a blocklist. You probably want two outcomes: it stops running now, and it cannot come back. A disabled extension meets the first goal. Whether it meets your incident needs depends on what the extension left behind, which the browser's policy docs do not promise to clean up.
What each vendor documents
| Browser | Setting | Existing copy |
|---|---|---|
| Chrome | installation_mode blocked | Users may not install it |
| Chrome | installation_mode removed | Blocks and removes if previously installed, Chrome 75 or later |
| Edge | Blocklist policy | Disabled, user cannot re-enable, not uninstalled |
| Firefox | installation_mode blocked | Prevents install and removes if already installed |
Google's help also says that for blocked permissions, extensions that need a blocked permission cannot be installed and previously installed ones stop loading. Microsoft says the same in different words: if an installed extension needs a blocked permission, it does not run, and it is disabled rather than removed.
What to do in an incident
- Use the strongest setting your browser offers. In Chrome that is removed. In Firefox it is blocked.
- In Edge, treat disabled as a first step, then follow your normal endpoint process to remove it.
- Check a sample machine afterward. Open the extensions page and confirm the item is gone or disabled.
- Assume secrets the extension could read may be exposed, and rotate them. Blocking does not undo what already happened.
- Record the extension ID, the date you blocked it, and the date you verified it.
We cover the wider response in our post on responding to a malicious browser extension.
Data left on disk
Edge's documentation is explicit that the blocked extension is not uninstalled. That can mean stored settings and cached data stay on the machine. Our post on extension data after clearing browsing data explains why clearing history does not always clear extension storage.
A policy habit
Keep two lists. The first is a standing denylist of IDs you have seen cause trouble. The second is your approved list. Review both on a schedule, and make sure each entry has a note on why it is there. A denylist with no notes turns into folklore within a year.
Safeguard note
Safeguard's asset discovery and its browser extensions can help you see what runs in your environment, and there is a free scan at gold.safeguard.sh/scan. Removing an extension is still done through your browser management.
Quick check
Is a disabled extension safe to leave installed?
It no longer runs, but it is still on disk. If it was malicious, remove it and rotate anything it could have read.
Which Chrome mode removes an existing extension?
The removed mode. Google's help says it blocks installation and removes the extension if it was previously installed.
Sources
- Manage Chrome extensions, Chrome Enterprise help
- Use group policies to manage Microsoft Edge extensions, Microsoft Learn
- ExtensionSettings policy, Firefox administrator reference
Last reviewed: 19 October 2026.
