Information
Enabling this setting allows you to specify which extensions the users can NOT install. Extensions already installed will be removed if blacklisted.
NOTE: Chrome does offer a more granular permission based configuration called Extension management settings if blacklisting all extensions is too aggressive, which allows an organization to drill down to the exact permissions that they want to lock down. The extensions management settings requires more coordination and effort to understand what the security requirements are to block site and device permissions globally as well as more IT management to deploy the policy, the benefit would allow access to more extensions to their end-users. See link in reference section
NOTE 2: If Chrome Cleanup is Disabled, users my want to configure the extension blacklist instead of using the Extension Management option. Chrome Cleanup can help protect against malicious extensions when paired with the Extension Management policy.
Rationale:
This can be used to block extensions that could potentially allow remote control of the system through the browser. If there are extensions needed for securing the browser or for enterprise use these can be enabled by configuring either the policy Configure extension installation whitelist or the policy Extension management settings.
Solution
To establish the recommended configuration via Group Policy, set the following UI path to Enabled with value * specified.
Computer Configuration\Administrative Templates\Google\Google Chrome\Extensions\Configure Extension Installation Blacklist
Impact:
Any installed extension will be removed unless it is specified on the extension whitelist, if an organization is using any approved password managers ensure that the extension is added to the whitelist.
Default Value:
Disabled. users can install any extension in Google Chrome.