Microsoft Overhauls Edge Add-ons Store Security with 15-Day Badge Rotation and AI-Powered Screening

Microsoft has introduced a 15-day rotation cycle for its store badges and overhauled security screening operations for the Microsoft Edge Add-ons Store. The move addresses growing security risks in browser extensions alongside a massive surge in submissions driven by artificial intelligence coding tools.

Browser add-ons remain a frequent target for cybercriminals seeking to compromise sensitive user data or steal cryptocurrency assets. Because extensions operate with elevated privileges within the web browser, malicious actors have routinely exploited browser add-ons across both Google Chrome and Chromium-based platforms like Microsoft Edge to execute clipboard hijacking, exfiltrate session tokens, and steal credentials.

The redrawn curation strategy targets the store’s “Featured” badge program—a designation signaling that an extension is a trusted piece of code with a commitment to quality, reliability, and security. By evaluating and refreshing badge assignments every 15 days, Microsoft aims to improve the discoverability of well-developed extensions while ensuring that developers who invest in quality and security receive prompt recognition in the marketplace.

In the past, static verification markers such as the “Featured” badge have proven ineffective at completely preventing malicious add-ons from reaching users. Under the revised store policies, Microsoft aims to make it easier for users to locate extensions they can trust while enforcing stricter, continuous evaluation for highlighted software.

The structural changes to the Microsoft Edge Add-ons Store follow a rapid rise in software creation driven by “AI-assisted” coding models, a trend commonly referred to in developer communities as “vibe-coding.” Generative AI tools—such as GitHub Copilot, OpenAI’s ChatGPT, Anthropic’s Claude, and AI-native integrated development environments like Cursor—have lowered the entry barrier for programming, making it easier than ever for non-traditional developers to build fully functional browser add-ons using natural language prompts.

To manage the unprecedented submission volume, Microsoft is deploying an increasingly automated review pipeline that leverages AI-based functionality to execute “repeatable validation checks.” These automated systems scan submitted code builds to rapidly identify well-known policy violations, programming flaws, and security vulnerabilities.

Microsoft considers the rise of vibe-coding a welcome development overall, noting that AI assistance allows developers to significantly reduce the time required to iterate on and build software projects. However, the resulting “Cambrian explosion” in extension development and store submissions has forced the company to alter its review infrastructure to maintain operational pace.

Under the updated workflow, automated AI systems handle initial screening, while human reviewers are assigned to evaluate complex cases that require manual inspection. Microsoft emphasized that quality standards within its review policy remain unchanged, with automation intended to maintain existing standards while accelerating processing times.

The streamlined review workflow is intended to benefit both extension creators and the broader ecosystem. Third-party developers can expect updated code builds to move faster through the review pipeline, while Microsoft seeks to establish the Edge ecosystem as the optimal platform to publish, manage, and download browser extensions.

The operational shift aligns with broader structural changes across the browser industry. Microsoft Edge transitioned its core underlying architecture to Google’s open-source Chromium engine in January 2020, unifying its extension engine with the wider Chromium ecosystem. Edge users can install extensions from both the native Microsoft Edge Add-ons Store and the Chrome Web Store.

Simultaneously, browser vendors have been transitioning extensions to the Manifest V3 framework specification. Manifest V3 restricts external code execution by requiring extensions to include all code directly within their submission packages and replacing background pages with short-lived service workers, a technical structure designed to make automated code analysis and security verification more effective against unauthorized data access.