Find the malicious extensions in the browsers that open your apps. Without installing anything.
People open your internal apps on work laptops, personal phones and home computers. You can’t put an agent on most of them. You don’t need to. Add one header to your app and every browser that opens it reports scripts and connections that don’t belong. We check each one and tell you when it’s malicious.
- 99%
- of enterprise users have a browser extension
- No agent
- on any device
- Minutes
- to set up
Your security tools can’t see inside the browser
Extensions and injected scripts run inside the page. They can read what’s on screen, change it, and send it somewhere else. None of that shows up in your server logs, your WAF or your EDR.
- 99%
- of enterprise users have at least one browser extension. 53% have one with high or critical permissions.
- LayerX, Enterprise Browser Extension Security Report 2025
- 30%
- of breaches involve a third party, double the year before.
- Verizon 2025 Data Breach Investigations Report
- 8M+
- installs of Urban VPN and its sister extensions, caught collecting users’ AI chats in 2025.
- The Hacker News, December 2025
Works on devices you don’t manage
You can’t install EDR on a contractor’s laptop or someone’s personal phone. You don’t have to. The header comes with your app, so every browser that loads the app reports back.
Nothing to install
No agent, no MDM, no extension of our own. It’s one HTTP header on your app.
Any browser, any device
Work laptop, personal phone, a contractor’s machine. If it opens your app, it reports back.
Set up in minutes
Copy the header from your dashboard into your app. Reports start on the next page load.
How it works
One header on the app you already run. No code changes, no new servers.
- 1
Add one header
Copy a report-only Content Security Policy (CSP) header from your dashboard into your app. Already have a CSP? It’s a copy of your policy with our URL added. No CSP? We give you one.
- 2
We check every report
When a script or connection breaks the policy, the browser reports it to us. We look up the URL in several threat-intel sources.
- 3
You get alerted
Detections show up on your dashboard, by email, in Slack, and at your webhook. Already collect CSP reports? We forward them to your collector unchanged.
Evidence for your audits
Your detection history shows that you watch for malicious code in the browsers that use your apps.
OWASP Top 10 2025 · A03
Software supply chain
Know when a malicious script or extension shows up in a browser that uses your apps.
HIPAA · GDPR
Data protection
If your apps handle regulated data, find out when a malicious script tries to send it somewhere.
SOC 2 · ISO 27001
Audit evidence
Continuous monitoring with alerts is the kind of control auditors ask to see.
This supports these programs. It doesn’t replace a compliance assessment. Handle card data? It also helps with PCI DSS 4.0.1 requirements 6.4.3 and 11.6.1.
Catch malware on devices you can’t put an agent on
Create an account, add the header to your app, and you’re done.