topic Re: Block browser extensions on a CheckPoint firewall in General Topics

Block browser extensions on a CheckPoint firewall

SubZer0 — Tue, 31 Dec 2024 21:31:37 GMT

A while ago, I was thinking about how to block browser extensions on a CheckPoint firewall. Today's news, "16 Chrome Extensions Hacked in Large-Scale Credential Theft Scheme," reminded me that controlling browser plugins can be an important security measure for organizations. Has anyone tried blocking browser extensions with CheckPoint? Any ideas or suggestions?

Re: Block browser extensions on a CheckPoint firewall

Lesley — Wed, 01 Jan 2025 10:24:04 GMT

No there is no way on a firewall to do this.

Best approach is:

https://support.google.com/chrome/a/answer/9296680?hl=en

There are more ways like inTune / GPO etc. But from firewall point of view I am not aware of an option to do this.

Re: Block browser extensions on a CheckPoint firewall

the_rock — Wed, 01 Jan 2025 15:51:12 GMT

Best way I can think of is to block QUIC protocol.

Andy

Re: Block browser extensions on a CheckPoint firewall

PhoneBoy — Thu, 02 Jan 2025 19:05:14 GMT

You can probably block chromewebstore.google.com with the firewall, though it may require HTTPS Inspection to be enabled.
The real solution is to implement this via GPO/MDM or via Google Enterprise.

Re: Block browser extensions on a CheckPoint firewall

MAX_0x07DF — Thu, 25 Jun 2026 11:28:01 GMT

For those who have the same question I can suggest the following solution.
You can block the chromewebstore and control which extensions are allowed for your users.
SSL-inspection must be turned on.
Next, you need to create a Custom application/site without turning on definition as RegExp with these URLs:
-lh3.googleusercontent.com/
-www.gstatic.com/_/mss/boq-chrome-webstore/
-clients2.google.com/
-clients2.googleusercontent.com/
Then, you can add full URLs for extensions that are allowed in your organization.

Re: Block browser extensions on a CheckPoint firewall

Ruan_Kotze — Fri, 26 Jun 2026 06:04:13 GMT

Applying controls on the firewall layer would be like playing whack-a-mole. Rather enforce "at source". Restrict the browsers that can be used on endpoints and centrally manage the browsers you allow. Both Edge and Chrome make this fairly easy to do, either via on-prem GPO or Intune CSP's.