Force-installing an extension through Chrome policy means it installs silently, users cannot uninstall or turn it off in the browser interface, and it receives permissions implicitly, including two enterprise-only APIs. In effect you are vouching for it on every managed browser, so it needs an owner and a review.
What the policy says
Chrome's ExtensionInstallForcelist policy is the usual way to push an extension to a fleet. Its definition in the Chromium source states that listed extensions "install silently, without user interaction" and that users cannot remove or disable them through the browser. Permissions are granted implicitly, including for the enterprise.deviceAttributes and enterprise.platformKeys extension APIs. Those two APIs are not available to extensions that are not force-installed.
The same definition says the policy supersedes ExtensionInstallBlocklist. If an extension is on both lists, it installs. And if you later remove it from the force list, Chrome uninstalls it automatically.
Why this changes the risk picture
A user who installs an extension from the store sees a permission prompt and makes a choice. A force-installed extension skips that moment. Nobody on the receiving end consented, so the consent has to happen earlier, in your review.
Three things follow:
- Scale. One extension update can reach every managed browser. A bad release is a fleet-wide event, not an individual one.
- Permanence. Users cannot remove it, so a worried employee has no quick fix except asking you.
- Extra reach. Access to device attributes and platform keys APIs is only useful to a small set of extensions. If your extension does not need them, ask why it is being force-installed rather than offered.
Who should own a force-installed extension
Give each forced extension a named owner, a stated business reason, and a review date. A simple record looks like this:
| Field | Example entry |
|---|---|
| Extension ID | the 32-letter ID from the extensions page |
| Why forced | needed for a company SSO workflow |
| Owner | a named person or team, not a mailbox |
| Permissions reviewed | date and reviewer |
| Next review | a calendar date |
| Removal plan | what to do if the publisher changes or is compromised |
See the owner register template for a longer version.
A short decision rule
Force-install only when the extension is part of how the company works and every employee in scope needs it. For anything optional, allow it and let people choose. That keeps the force list short, and a short list is easier to review after every publisher change.
If you need to see what else is in the browser, an inventory of browser extensions helps you spot what policy does not cover.
Where Safeguard fits
If the forced extension is one your own team builds, Safeguard's dependency scanning and SBOM generation cover its npm dependencies before release, and policies and gates can block a release that adds a risky package. You can try a free scan at gold.safeguard.sh/scan.
Quick check
Can a user remove a force-installed extension?
Not through the browser interface. Chrome's policy definition also says the prevention is best effort, because some operating systems make it hard to defend against external modification.
What happens if I remove an extension from the force list?
Per the policy definition, Chrome automatically uninstalls a previously force-installed extension once it leaves the list.
Does force-install override a blocklist entry?
Yes. The definition says the force-install policy supersedes the blocklist policy.
Sources
Last reviewed: 19 October 2026.
