>
    Strata Copilot
    Advanced Extension Security
    Focus
    Download PDF
    Focus
    1. Home
    2. Prisma Browser
    3. Prisma Access Browser Administration
    4. Manage Prisma Browser Extensions
    5. Advanced Extension Security
    Download PDF
    Prisma Browser

    Advanced Extension Security

    Table of Contents

    Advanced Extension Security

    Advanced Extension Security
    Where Can I Use This?What Do I Need?
    • Advanced Extension Security capabilities vary by tier. Features marked (Prisma Browser Pro and above) below require the corresponding license.
    The Advanced Extension Security enhances the extension policy framework with additional capabilities:
    • Features open for all customers:
      • The AXS Detection and Protection Engine — A powerful in-house engine that detects and classifies extensions as Malicious, High Risk, Medium Risk, or Low Risk.
      • Version-level granularity — Each extension version is evaluated, tracked, and enforced independently.
    • Prisma Browser Pro and above:
      • Block Malicious policy rule — scope enforcement exclusively to malicious extensions, without blocking high-risk or medium-risk extensions.
      • Block Unknown Verdict — block extensions that have not yet received a classification.

    AXS Detection and Protection Engine

    The AXS Detection and Protection Engine, built by Palo Alto Networks Cloud-Delivered Security Services (CDSS) team, is a multi-layered detection system purpose-built for browser extension threats. It classifies extensions into four categories: Malicious, High Risk, Medium Risk, and Low Risk.
    Inline Analysis: Real-time detection through analyzers such as Program Taint Analysis, which tracks sensitive data flows and applies JavaScript deobfuscation to uncover hidden behaviors. At GA, the engine focuses on high-confidence inline detection.
    Threat Intelligence: External intelligence sources enrich detection — including URL intelligence (AURL) and WildFire threat intelligence — providing visibility into malicious infrastructure, extension distribution vectors, and associated malware campaigns.
    Key Distinction: Risk (Low / Medium / High) reflects an extension's potential for harm based on its behavioral profile. Malicious is a definitive verdict that the extension is actively harmful. An extension can be High Risk without being Malicious, and a previously Low-Risk extension can be reclassified as Malicious following a version update.

    Version Level Controls

    Previous policy enforcement treated an extension as a single entity identified by its Extension ID. Advanced Extension Security introduces version-level granularity, meaning each version of an extension is evaluated independently.
    How It Works:
    • Each extension version (e.g., Grammarly v1.0, Grammarly v1.1) is analyzed and tracked as a distinct entity.
    • If a specific version introduces malicious behavior — for example, through a compromised update — that version is identified and blocked without affecting known-good versions.
    • The Extensions Inventory now displays, for each extension:
    • The number of distinct versions installed across the organization.
    • The list of users associated with each version.
    Why This Matters:
    Scenario: A trusted extension pushes a malicious update in v2.3
    • Before (ID-Level): The entire extension (all versions) must be blocked or allowed.
    • After (Version-Level): Only v2.3 is flagged and blocked. Users on v2.2 remain unaffected.
    Scenario: Investigating a security incident
    • Before (ID-Level): Admin sees "Extension X is installed by 500 users."
    • After (Version-Level): Admin sees "v2.2 is installed by 480 users; v2.3 (malicious) is installed by 20 users."

    Block Malicious Extensions Rule

    A new policy rule type, Block Malicious Extensions , is now available alongside the existing Block by Risk rules (Block Medium Risk, Block High Risk). This rule blocks any extension that the AXS Detection Engine has classified as Malicious.
    This rule is available to Prisma Browser Pro customers and above.
    When an extension version receives a Malicious verdict, the Block Malicious rule removes it from all devices where the policy is applied. Unlike risk-based blocking, the Malicious classification reflects a confirmed threat rather than a risk posture.

    Enable The Advanced Extension Security

    To configure extension blocking by risk level or malicious verdict:
    1. Navigate to Rules > Browser Security > Allowed or Blocked Extensions.
    2. Select Block specific extensions by ID or Risk from the dropdown.
    3. Check the Block extensions by risk level checkbox.
    4. Adjust the slider to the desired level:
      • Malicious — Blocks only extensions with a confirmed malicious verdict (Prisma Browser Pro and above).
      • High Risk - Blocks Malicious and high risk extensions.
      • Medium — Blocks malicious, high-risk, and medium-risk extensions.

    Extensions Inventory View

    You can view version-level details for an extension.
    1. Click Extensions on the Navigation pane.
    2. Select an extension from the list.
    3. A card with the dtails appears on the right-side, displaying
      • All installed versions of the extension across the entire organization.
      • A list of users associated with each version.
    This view enables you to identify which users are running a specific version — particularly useful when a version update introduces malicious behavior and targeted remediation is required.

    Recommended Policy Configurations

    Prisma Browser Pro and above:
    • - Block Malicious is recommended as a baseline for the entire fleet. This ensures confirmed threats are removed without disrupting legitimate extensions.
    • Layer additional risk-based policies (Block High Risk, Block Medium) based on your organization's risk tolerance and operational needs.
    All other tiers:
    • Block High Risk is recommended as the default policy to protect against the most dangerous extensions.
    For more information on policy stacking, precedence rules, and advanced configurations, see the Extension Security Best Practices Guide.

    Frequently Asked Questions

    1. What is the difference between Block by High risk extensions and Block Malicious extensions?
    Block by Risk filters extensions based on a risk classification (Medium, High). Its precedence behavior with other rules is documented in the Extension Policy Best Practices Guide.
    Block Malicious acts on a definitive Malicious verdict from the AXS Detection Engine, indicating a confirmed threat.
    2. If one version of an extension is malicious, are all versions blocked?
    No. With version-level control, only the specific version classified as Malicious is blocked. Other versions of the same extension remain subject to standard policy resolution.
    3. What does Block Unknown Verdict do?
    Extensions that have not been analyzed and classified by the AXS engine are marked as Unknown. Enabling Block Unknown Verdict prevents these unclassified extensions from running until a verdict is issued. This is available to Prisma Browser Pro customers and above.

    © 2026 Palo Alto Networks, Inc. All rights reserved.