IT & Security Review

Audience: IT, security, and network teams reviewing the Pyze browser extension before deployment. This page answers the standard vendor-review questions in one place. Deployment steps are in the install guides.

The extension ships in two deployment models. Everything below applies to both unless a row says otherwise.

Supported Browsers

The extension uses Manifest V3 and runs its page script in the main world, which is why Chrome and Edge 111 are the floor. The NativeHostsExecutablesLaunchDirectly policy used on locked-down Windows images needs Chrome 120 or Edge 121; see Native Host Troubleshooting.

Packaging and Distribution

Package. One store-signed package, published to the Chrome Web Store and Microsoft Edge Add-ons under Pyze’s developer account. Each customer gets a dedicated build with its own extension ID. The Pyze app key and the approved domain list are compiled in and cannot be changed by users. There is no settings page or popup. Where the store cannot be used, Pyze supplies the same build as a signed .crx for internal hosting; see the non-store guide.

Distribution. Force-install with the browser policy already in use: Intune Settings Catalog, Group Policy ExtensionInstallForcelist, or the ExtensionSettings JSON policy. The browser downloads the package into the user’s profile. Nothing runs on the endpoint outside the browser.

ExtensionInstallForcelist value:

<extension-id>;https://clients2.google.com/service/update2/crx

ExtensionSettings value:

{"<extension-id>":{"installation_mode":"force_installed","update_url":"https://clients2.google.com/service/update2/crx"}}

Force-installed extensions show Installed by your organization and cannot be disabled or removed by users.

Updating. Pyze publishes to the store and browsers update automatically. Pyze notifies the customer before any release that changes permissions or the domain list. For non-store deployments the customer replaces update.xml as described in the non-store guide.

Removal. Delete the force-install entry. The browser uninstalls the extension on every managed device at the next policy refresh and deletes its local storage. Add the ID to ExtensionInstallBlocklist to prevent reinstallation. In the extension-only model nothing else remains on the endpoint. In the native host model, remove the host as described in the deployment guide you used.

Manifest and Permissions

{
  "manifest_version": 3,
  "name": "Pyze <Customer>",
  "version": "<build version>",
  "permissions": ["storage"],
  "host_permissions": ["*://*.<approved-domain-1>/*", "*://*.<approved-domain-2>/*", "..."],
  "background": { "service_worker": "pyze-service-worker.js" },
  "content_scripts": [
    { "matches": ["<same list>"], "js": ["content-bridge.js"], "all_frames": true, "run_at": "document_start", "world": "ISOLATED" },
    { "matches": ["<same list>"], "js": ["pyze.js"],           "all_frames": true, "run_at": "document_start", "world": "MAIN" }
  ]
}

What the Extension Collects

The extension collects interaction metadata, not content.

Collected

• Element identifiers of the clicked or focused control
• Page title and URL of the approved page
• Interaction events
• Page load-time metrics
• Tab-switch events, with the hostname for approved sites and restricted: true for everything else

Never collected

• Typed text or field values
• Clipboard contents
• Selected text
• Anything in password fields
• Username, email, employee id, or any OS or hardware identifier (extension-only model)

In the native host model the host reads the signed-in OS username and sends only its SHA-256 hash, plus a per-machine id. See the Privacy Note.

Endpoint-Administration Privileges

Extension only: none. The extension is installed into the user’s browser profile by the force-install policy. Nothing is written to Program Files, HKLM, or /Library, and no services, scheduled tasks, or registry entries are created beyond the browser’s own policy keys. On Citrix and shared images the same policy applies to every session with no image changes.

Extension + native host. The native host binary and its manifest are placed at a fixed machine-wide path (C:\Program Files\Pyze\ on Windows, /Library/Application Support/Pyze/ on macOS) and registered under HKLM\SOFTWARE\<browser>\NativeMessagingHosts or the system NativeMessagingHosts folders. This needs system rights once, through your packaging tool. No services or scheduled tasks are created, and the host runs only when the browser launches it. Details are in the store and non-store deployment guides.