Browser extensions can quietly access SaaS data, cookies, admin consoles and AI workflows. Use this practical 2026 checklist to inventory, approve, restrict and review extensions before they become shadow IT risk.