The European Union’s Digital Markets Act (DMA), adopted in 2022, moved from legislative text to tangible market change by mid‑2026. Who: major browser vendors designated as gatekeepers and hundreds of extension publishers. What: live support for alternative extension stores, expanded sideloading pathways and changes to signing/verification flows. When: throughout 2024–2026 these changes were rolled out; the market has shifted materially by July 2026. Where: across the EU and, in practice, in global builds of browser software. Why it matters: enterprises must update procurement, security controls and approval workflows now to manage a larger, more complex extension supply chain.
Context: how DMA moved from policy to platform change
The DMA’s objective—preventing a small set of firms from locking users into single storefronts—has been enforced through designation and remedial obligations. Since 2024, browser vendors required to meet DMA obligations have implemented new extension storefront APIs, user‑choice dialogs and reduced technical friction for third‑party distribution. That has produced three practical results: more places where extensions can be discovered and installed, more sideloading vectors (especially on desktop OSes), and divergent signing/verification mechanisms across stores.
What enterprise teams are seeing in practice (mid‑2026)
- Multiple official and unofficial extension galleries. Several browsers now accept registrations of third‑party stores or allow side‑loading from vendor‑approved partners. Enterprises that historically managed one canonical store view now face multiple galleries to monitor.
- Sideloading and external installers are more common. Vendors have relaxed some technical barriers for non‑store installs to comply with DMA interoperability requirements; desktop installers and extension packages distributed via enterprise portals are increasingly used.
- New provenance signals — and new complexity. Alternative signing authorities, publisher‑managed update channels and store‑specific metadata mean “who signed this extension” is no longer a single, consistent signal across environments.
- Enterprise‑focused distributors have emerged. Starting in 2025, specialist marketplaces and publisher portals marketed “enterprise‑ready” bundles with additional attestation and SLAs; adoption is growing but not universal.
Concrete risks observed
Security teams should treat increased openness as a change in adversary calculus rather than a purely positive market shift. Key risks seen in 2024–2026 deployments include:
- Extension sprawl and shadow installs. IT inventories show a 20–30% increase in unique extension identifiers across monitored estates where third‑party stores are allowed (Enterprise Browser Watch telemetry, internal customer panels, 2025–26).
- Fragmented vetting. Independent stores apply different review standards; feature parity does not guarantee uniform security practices or update cadence.
- Provenance and update chain ambiguity. Multiple signing authorities and publisher‑hosted updates complicate forensic timelines and coordinated vulnerability response.
- Policy gaps in legacy MDM/GPO setups. Many enterprises found existing Group Policy Objects or MDM profiles blocked an old single store but failed to account for external installers or new store origins.
What enterprise browser teams should do now (practical, prioritized)
The following actions reflect controls and procurement steps that will make an immediate difference in July 2026 operations.
1. Rebaseline — automated, continuous inventory
Perform a fresh extension inventory across endpoints and BYOD using endpoint agents and browser‑level telemetry. Capture extension IDs, publisher fingerprints, signing certificates, install source (store origin or sideload), and last update times. Repeat this at least weekly during the transition period.
2. Tighten policies with explicit allowlists and publisher pins
Use vendor enterprise policies (Chrome/Edge “ExtensionInstallAllowlist” and “ExtensionsSettings”; Firefox “xpinstall.whitelist” equivalents; Jamf/Intune profiles) to block unsanctioned installs while explicitly allowing vetted stores or publisher certificate fingerprints. Where possible, pin to publisher certificate thumbprints rather than store identifiers.
3. Expand vetting to include behavior and SBOMs
Require extension publishers to provide a Software Bill of Materials (SBOM), a documented update channel, and vulnerability disclosure timelines in procurement. Add automated dynamic behavior analysis (sandboxed telemetry) to detect excessive permissions, C2 domains, or data exfiltration patterns before approval.
4. Integrate extension telemetry into SOC workflows
Ingest extension events (install, update, permission change) into SIEM and EDR. Create playbooks for rapid rollback and revocation of enterprise force‑install lists. Test a “breaker” process that can remotely disable a publisher’s extension via enterprise management if an urgent vulnerability is found.
5. Negotiate stronger vendor commitments
Update contracts to require: signed releases, cryptographic provenance metadata, 24‑hour vulnerability response SLAs for critical issues, and post‑incident forensic support. Make update mechanisms auditable and require that publisher update endpoints support mutually authenticated TLS and change logs.
6. Use isolation and policy controls where risk is unacceptable
For high‑risk user groups (finance, HR, R&D), apply browser isolation (remote rendering or strict content isolation), disable third‑party stores entirely, or permit only a curated enterprise store. Combine with DLP rules to reduce data exposure if an extension is compromised.
Impact and who this affects
These changes matter for IT procurement, security operations, legal/privacy and desktop engineering. Procurement teams will see more vendor options and must demand stronger attestation; security teams must extend monitoring and update lock‑step responses; privacy teams must reassess cross‑border processing when third‑party stores host telemetry or update servers outside the EU.
Reactions in the market
Browser vendors argue the changes increase user choice and foster competition. Enterprise security vendors are racing to add extension telemetry and automated vetting to their platforms. Independent marketplaces are positioning enterprise bundles with certification and SLAs, but adoption depends on the rigor of those certifications and how easily IT can integrate them into existing management tooling.
What to watch next (next 6–12 months)
- European Commission guidance and supervisory decisions refining gatekeeper obligations for extension provenance and review standards.
- Standardization efforts around extension SBOMs and unified signing metadata — industry consortia discussions are active in 2026.
- Enterprise tooling updates: expect major EDR/SIEM vendors to deliver built‑in extension analysis modules through 2026.
Bottom line
The DMA’s impact on browser extension distribution is no longer theoretical. By July 2026 the ecosystem offers more choice — and more management complexity. Enterprise browser teams should treat this as an operational priority: rebaseline inventories, pin publishers, demand SBOMs and contractual SLAs, integrate extension events into SOC workflows, and apply isolation where necessary. These steps will let organizations capture the DMA’s benefits without sacrificing governance and security.
FAQ
Can I block all third‑party extension stores without violating the DMA?
Yes — DMA obligations apply to designated gatekeepers, not to individual enterprises. You may impose stricter internal controls (block third‑party stores, disable sideloading) for security or compliance reasons. Document the business and risk rationale — and prepare exceptions handling for vetted enterprise vendors.
How should I validate a publisher’s signing and update chain?
Require cryptographic signing metadata and pin publisher certificate thumbprints in management policies where supported. Validate update endpoints use mutually authenticated TLS and provide signed update manifests. Keep a recorded chain‑of‑custody for approved publishers as part of procurement records.
Are enterprise marketplaces safer than public stores?
Not automatically. Enterprise‑focused marketplaces can offer stronger attestations and SLAs, but their security depends on their vetting standards and transparency. Treat each marketplace as a vendor: audit their processes, require SBOMs, and integrate their telemetry into your monitoring.
What monitoring signals should I prioritize?
Prioritize install/update events, permission changes, outgoing connections from extension contexts, and anomalous data access from browser processes. Feed these into SIEM and EDR and test automated revocation playbooks.