Who, what, when, where, why — straight away: As of August 2026, the cross‑vendor enterprise extension signing and attestation standard that browser vendors and enterprise partners began developing in 2024–2025 has reached a broadly consequential milestone: the working group published a stable v1.0 specification in March 2026 and several major vendors and management platforms now support its allowlist, attestation API, and provenance metadata. The result is a real operational path for IT teams to reduce extension supply‑chain risk across managed Chrome‑ and Chromium‑based browsers and to a more limited degree on Firefox. This update explains what has shipped, what still matters, and what IT must do now.

Context: how we got here

The standard was created to address two enduring enterprise problems: uneven publisher identity and build integrity across extension stores, and per‑vendor management fragmentation that raises operational cost and security gaps. The specification defines a machine‑readable provenance block (publisher identity, build fingerprints, SBOM reference), a standardized attestation API, a revocation protocol, and a cross‑vendor allowlist schema. Those building blocks were intended to let management consoles verify artifacts before deployment and to enable consistent enterprise policy enforcement.

Between late 2024 and early 2026 the working group—composed of browser vendors, managed‑browser vendors, enterprise customers and security firms—ran public drafts and multi‑vendor pilots. That effort culminated in a v1.0 text published March 4, 2026, which the group described as "stable and implementable" for managed‑browser scenarios. Vendors then staged rollouts to avoid breaking existing deployments.

What’s actually shipped (August 2026)

  • Chrome & Edge (Chromium‑based): Google Chrome and Microsoft Edge implemented the common attestation API and support the provenance block in their enterprise builds. Both browsers expose attestation verification calls to management consoles so administrators can block unsigned or unverifiable artifacts at install time.
  • Firefox: Mozilla shipped partial support focused on attestation and allowlist compatibility; some legacy Firefox extension formats require adaptation or a migration shim to meet the provenance schema.
  • Safari: Apple has signaled interest but has not adopted the full v1.0 runtime attestation model, citing differing extension packaging and App Store controls. Enterprises using macOS/iOS environments should expect a longer migration window.
  • Management consoles: Microsoft Intune, Google Workspace (Admin console), VMware Workspace ONE and several UEM/MAM vendors released integrations that can consume the allowlist schema, call the attestation API, and enforce revocation signals from the vendor network.
  • Security tooling: Leading enterprise security vendors integrated SBOM parsing and provenance‑based risk scoring into their extension‑risk products, allowing automated risk classification during procurement and deployment.

Real‑world uptake and evidence

Adoption to date is uneven but tangible. Large financial services and technology firms that participated in pilots report fewer false positives in extension allowlisting and faster forced‑remediation during incidents. Vendor telemetry released with v1.0 indicates enterprises that enforced attestation at install reduced the number of extension remediation cases requiring manual intervention by anecdotally "more than half" during pilot windows; independent third‑party audits are now underway to quantify that improvement for public reporting.

Two important adoption patterns have emerged:

  1. Greenfield and new deployments move fastest: Organizations that standardize on Chromium‑based managed browsers and use a single UEM saw the quickest benefit because they could adopt the allowlist schema and attestation checks end‑to‑end without legacy compatibility constraints.
  2. Legacy internal extensions slow migration: Many enterprises still run internally developed extensions that lack signing, reproducible builds, or SBOMs. These require either a short‑term policy exception, an internal re‑signing program, or refactoring to meet the provenance requirements.

Impact — who is affected and how

Security teams gain a more auditable control plane for extensions. Procurement and compliance functions can now demand signed provenance and SBOMs as contractual requirements with clearer enforcement paths. On the operations side, help desks face an initial migration burden—cataloguing legacy extensions, coordinating re‑signing or SBOM generation, and updating allowlist rules—but fewer post‑incident remediation tasks once attestation enforcement is in place.

Stakeholder reactions

Vendor spokespeople emphasized cautious optimism. A vendor statement distributed by the working group called the rollout "the first time enterprises can rely on a single, auditable provenance layer across major managed browsers." Enterprise pilot participants told Enterprise Browser Watch the standard reduced procurement friction and simplified third‑party risk assessments during RFPs.

Privacy advocates and internal audit teams continue to scrutinize telemetry. The working group’s privacy assurances—that attestation transmits only artifact and policy metadata, not browsing data—remain central to acceptance. Several large enterprises required independent privacy reviews before enabling cloud‑based attestation services in their environments.

Remaining gaps and risks

  • Vendor parity: Chromium vendors lead; Firefox is partially supported; Safari remains an outlier. Cross‑browser parity remains the single biggest adoption risk.
  • Legacy migration: Internal extensions and third‑party packages that lack build provenance or SBOMs require tailored migration paths—often manual—and this is the primary operational friction reported by IT teams.
  • Attestation trust anchors: Enterprises must decide whether to rely on vendor attestation services, run their own attestation validators, or adopt hybrid architectures—each choice affects cost, latency and control.

Practical advice for IT and security teams (what to do now)

  • Inventory today: Complete an extension inventory by Aug–Sep 2026 that records publisher, version, install scope, business criticality and whether a signed provenance block and SBOM exist.
  • Pilot attestation enforcement: Start with a controlled pilot on Chromium managed browsers and one UEM (e.g., Intune or Workspace ONE). Validate attestation calls, fallback behaviors and revocation workflows.
  • Plan legacy migration: For internal extensions, prioritize re‑signing and reproduction of deterministic builds. Target the highest‑risk or highest‑usage extensions for earliest migration.
  • Decide trust model: Choose between vendor‑hosted attestation, on‑prem validation, or hybrid. Document the decision in your browser security policy and run an independent privacy review if you enable vendor services.
  • Update procurement language: Require provenance blocks, SBOMs and attestation compatibility in new extension contracts and RFPs.

What’s next (what to watch for)

Watch for four signals through late 2026:

  • Apple’s position on Safari support—any move by Apple to align with v1.0 would substantially improve parity.
  • Independent audit results quantifying reduction in real‑world remediation time and incident windows.
  • Open‑source tooling and shims that simplify SBOM generation and provenance embedding for legacy extensions.
  • Regulatory or procurement mandates—if public sector buyers begin requiring provenance and SBOMs, adoption in financial and healthcare verticals will accelerate.

FAQ — common questions right now

Do I need to block extensions that aren’t signed immediately?

No. Treat the rollout as a staged program. Start with detection and allowlisting in reporting mode, pilot attestation enforcement for non‑critical groups, and then graduate to enforced blocking for high‑risk groups once migration paths for legacy artifacts are in place.

Can I run attestation validation on‑prem instead of using vendor services?

Yes. The v1.0 specification supports local validators and hybrid models. Running validation on‑prem increases control and minimizes telemetry leaving your environment, but it requires operational investment to host and maintain trust anchors and revocation feeds.

What about internal (in‑house) extensions that lack SBOMs?

Prioritize those by business criticality. For most teams the practical path is to (1) generate minimal SBOMs (package and dependency lists), (2) establish reproducible builds where feasible, and (3) embed provenance metadata and sign artifacts. Tools to automate SBOM generation have improved in 2026; evaluate those to accelerate migration.