Yes, in recent versions. Mozilla's ExtensionSettings policy has a private_browsing boolean, listed as available from Firefox 136 and ESR 128.8, that controls whether a given extension is enabled in private browsing. It is set per extension, not in the wildcard entry.
Why private windows matter to a security team
Developers often open a private window to test a login flow without cached state, to check a page as an anonymous visitor, or to reach a second account. In those moments an extension that can read page content can still see the session, unless it is switched off for private windows.
An extension that is allowed in private windows can see the same page data as in a normal window. That is the risk to think about, not the window mode itself.
What the policy field does
Mozilla's reference lists private_browsing under per extension fields. A true value enables the extension in private browsing, and a false value disables it there. The field is not documented for the wildcard entry, so set it on the IDs you approve.
{
"policies": {
"ExtensionSettings": {
"approved-extension@example.com": {
"installation_mode": "allowed",
"private_browsing": false
}
}
}
}
The ID is a placeholder. Use the real ID of the extension you approved.
Choosing a default
Think in terms of what the extension does.
| Extension role | Private browsing |
|---|---|
| Password or secrets helper | Decide per tool, test the flow first |
| Security scanner on page content | Often fine, since it supports testing |
| Ad or tracker blocker | Usually helpful in private windows |
| Anything that reads or rewrites all pages | Default off unless there is a reason |
These are starting points, not rules. The right answer depends on what the extension reads and where it sends it.
Version checks
The version numbers matter. Firefox 136 and ESR 128.8 are the first versions Mozilla lists for this field. If your laptops run an older release, the field will not do what you expect. Confirm versions across the fleet before relying on it, and read the current reference because policy documentation changes.
A test you can run in ten minutes
- Apply the policy to a test profile.
- Open a normal window and confirm the extension is active.
- Open a private window and check the extensions panel. Confirm the extension is not allowed to run there, if you set false.
- Visit a page the extension normally modifies, and confirm it does not.
- Remove the policy and confirm the behavior reverts.
Note the result and the Firefox version in your change record.
Related controls
Policy for private browsing sits beside the other extension controls. Read how to restrict Firefox extensions with ExtensionSettings first, then use this field for the extensions you keep.
Safeguard note
Safeguard offers a Firefox add-on and a free scan at gold.safeguard.sh/scan. Whether it runs in private windows is set by your browser policy.
Quick check
Is private_browsing set in the wildcard entry?
No. Mozilla's reference lists it among the per extension fields.
Which Firefox versions have it?
The reference lists Firefox 136 and ESR 128.8.
Sources
Last reviewed: 19 October 2026.
