A force-installed extension updates from the update location your policy names. In Chrome that is update_url, and override_update_url makes it win over the manifest. In Edge it is the update URL after the extension ID. In Firefox it is install_url or update_url. Chrome can also disable copies older than a version you set.
The update URL is part of the trust decision
When you force install, you are not only choosing an extension. You are choosing where its future versions come from. Whoever controls that location controls what runs on every machine in scope. That makes the URL as important as the extension ID.
What each vendor documents
| Product | Setting | Note |
|---|---|---|
| Chrome | update_url | Where Chrome downloads force and normal installed extensions |
| Chrome | override_update_url | Use the policy URL for later updates instead of the manifest URL |
| Chrome | minimum_version_required | Disables extensions older than the version, including forced ones |
| Edge | Extension ID, semicolon, update URL | Chrome Web Store hosted or self-hosted update manifest |
| Firefox | install_url, update_url | Rules vary by version, see the reference |
Google's help gives the Chrome Web Store update address as https://clients2.google.com/service/update2/crx. Microsoft shows a self-hosted example where the update URL points at an update manifest XML file.
Hosted store or self-hosted
| Approach | Benefit | Cost |
|---|---|---|
| Store hosted | Store handles distribution and review | You follow the publisher's release timing |
| Self-hosted internal | You control when versions ship | You must secure the host and keep it updated |
For internal extensions that only your staff use, self-hosting gives control, but the server becomes part of your supply chain. Protect it like a build artifact repository, with access control and logging.
Controlling stale copies
The minimum_version_required field is a useful safety valve. If an extension version is found to be vulnerable, set the minimum to the fixed version. Google's help says it disables extensions older than the version you set, including force-installed ones. See also our explainer on the minimum version policy.
Staged rollout for updates
You cannot always slow the publisher, but you can slow your own rollout of self-hosted updates. See staged rollout and rollback for extensions for a pattern.
Checklist
- Record the update URL for every force-installed extension.
- Confirm who controls that location.
- Decide whether to override the manifest URL in Chrome.
- Set a minimum version after any security fix.
- Review the list on a schedule and remove entries nobody owns.
Safeguard note
Safeguard can help you see what is installed through its asset discovery, and you can start with a free scan at gold.safeguard.sh/scan. Update URLs are set in your browser policy.
Quick check
What does override_update_url do in Chrome?
Google's help says Chrome then uses update_url or the force list URL for later updates instead of the URL in the extension manifest.
Can a minimum version disable a forced extension?
Yes. Google's help says minimum_version_required disables older versions, including force-installed extensions.
Sources
- Manage Chrome extensions, Chrome Enterprise help
- Use group policies to manage Microsoft Edge extensions, Microsoft Learn
- ExtensionSettings policy, Firefox administrator reference
Last reviewed: 19 October 2026.
