BGR's New Browser Security Checklist: Secure Your Passwords, Extensions, and AI Settings in 2025

The browser security playbook just got a rewrite. A new guide from BGR, published July 19, argues that the very features most users ignore—or outright disable—are now the keys to a safer online experience. Chief among them: the built-in password manager in Chrome and Edge, which, when locked behind a Windows Hello prompt, is far less of a liability than the “never save passwords” crowd would have you believe. The 5-point audit covers everything from extensions to AI models, and it applies to every major browser on Windows.

What BGR’s Audit Reveals About Modern Browser Security

For years, conventional wisdom told users to avoid saving credentials in Chrome, Edge, or Firefox. Third-party managers like Bitwarden or 1Password were the gold standard, while browser-based tools were seen as a convenience trade-off. BGR’s 2026 checklist flips that narrative. It points out that today’s built-in managers are tightly integrated with Windows authentication and active breach monitoring—capabilities that, when actually turned on, rival standalone utilities.

The report doesn’t stop at passwords. It calls out extensions as the most overlooked data-harvesting vector, declares the Do Not Track signal dead (something Firefox acknowledged last year), and warns that on-device AI models in Chrome could be downloading and learning in the background without explicit approval. For Windows users, these aren’t abstract concerns. They directly impact system performance, memory usage, and the overall attack surface of a PC.

Why Your Password Manager Is No Longer the Enemy

The old fear was simple: if someone gains access to your device, they own all your saved logins. That risk still exists, but BGR highlights two defenses that tilt the balance. First, Chrome and Edge now prompt for Windows Hello, a PIN, or a local password before autofilling credentials—on by default in Edge, and a single toggle in Chrome’s settings. Second, both browsers run continuous checks against known data breaches. Google’s Password Checkup has flagged billions of compromised credentials, and Edge uses the same underlying technology.

What’s the catch? These protections demand user attention. On a shared family PC, skipping the authentication step leaves saved passwords exposed to anyone with physical access. The fix takes seconds: open Chrome, go to Settings > Autofill and passwords > Google Password Manager, then enable “Use Windows Hello when filling passwords.” In Edge, it’s under Settings > Profiles > Passwords. Once on, the browser won’t surrender credentials without your face, fingerprint, or PIN.

For organizations, the calculus shifts further. Browser-based password managers tie into Azure AD and group policy, allowing IT to enforce authentication prompts, restrict password export, and monitor for breach alerts centrally. That doesn’t make them enterprise-grade vaults, but it means abandoning them entirely is no longer the clear-cut best practice.

The Extension Graveyard: Why You Should Bury Unused Add-Ons

Extensions are the forgotten backdoors of modern browsing. A single unmaintained toolbar or PDF converter can read and alter content on every page you visit. BGR’s advice is blunt: remove anything you don’t recognize or haven’t used in months.

Windows users often inherit extensions from bundled software or past “cleaner” tools. In Chrome, type chrome://extensions into the address bar to see the full list. In Edge, it’s edge://extensions. Look for entries with “This extension may have been changed without your knowledge” warnings—a sign the developer abandoned it. BGR recommends taking this a step further by disabling extensions that request broad “Read and change all your data on all websites” permissions unless they truly need them.

For IT admins, Microsoft offers a robust extension management toolkit via Edge group policies. You can block all extensions except a curated allowlist, force-install approved ones, and monitor inventory through the Edge management service. That granularity isn’t just for compliance; it directly reduces the risk of malicious updates hijacking employee browsers.

Tracking Protection in 2026: Do Not Track Is Dead, Long Live Cookie Controls

If there’s one setting BGR says you can stop toggling, it’s Do Not Track. The header, introduced over a decade ago, asked websites to honor a privacy preference. Most ignored it. Firefox finally removed the option in version 135, citing research that it could even make users more fingerprintable. Mozilla’s engineers called it “a signal that rarely achieved its goal.”

What actually works? Third-party cookie blocking. BGR advises turning it on but warns that embedded login prompts, payment widgets, and some video players may break. Chrome’s solution is per-site exceptions: when a site misbehaves, click the tune icon in the address bar, choose “Cookies,” and allow third-party cookies for that site only. This is messy—no unified dashboard exists—but it’s more effective than a global off switch.

Edge defaults to Balanced tracking prevention, which blocks some third-party cookies without breaking known sites. Switching to Strict mode stops more trackers but can cause visible page glitches. For home users, BGR’s recommendation is to try Strict for a week and dial back only if essential services fail. Enterprises should default to Balanced and manage exceptions via policy, avoiding the support nightmare of blanket breaks.

The Hidden Performance Drain: Memory Savers and Background Apps

Windows Task Manager doesn’t lie: Chrome and Edge can consume gigabytes of RAM, especially with dozens of tabs. BGR flags memory-saving features—first introduced by Microsoft Edge in 2020 and later adopted by Chrome—as must-review items. When enabled, inactive tabs release memory after a set time, reducing the browser’s footprint by 30-40% in typical use.

The trade-off is that tabs reload when you return to them, which can be slow on spinning hard drives or metered connections. On SSDs, the impact is negligible. In Chrome, navigate to Settings > Performance > Memory and toggle on “Memory Saver.” Edge has the same option under System and Performance > Optimize Performance.

Background processes are another stealth culprit. Both browsers can keep running after you close the last window, enabling apps like Gmail or Teams to send notifications. BGR suggests disabling “Continue running background apps when Google Chrome is closed” or the equivalent Edge toggle. On laptops, this can save meaningful battery life over a workday.

Startup behavior matters too. Do you really need 30 tabs reopening from your last session? In Settings > On startup, choose “Open the New Tab page” if you prefer a clean slate, or selectively pin essential tabs and let the rest hibernate.

AI Is Learning Your Habits—Here’s How to Rein It In

Perhaps the most eyebrow-raising setting BGR surfaces is Chrome’s “On-device AI.” According to Google’s documentation, Chrome may download generative AI models in the background for features like writing assistance, scam warnings, tab organization, and page summaries. These models run locally, but the initial download can be several hundred megabytes, and they continuously process your interactions.

BGR treats this as a new pillar of browser hygiene: AI settings deserve the same scrutiny as telemetry and sync. In Chrome, the master switch is under Settings > Experimental AI > On-device AI. Turning it off removes the downloaded models and disables dependent features, but note that some AI functions—like enhanced spellcheck—may remain active under separate toggles.

Edge’s Copilot integration is more visible but also more controllable. The sidebar can be hidden, and the “Show Copilot on text selection” option can be turned off under Settings > Copilot. For privacy-conscious users, BGR’s recommendation is to disable any AI feature that processes page content or keystrokes unless you explicitly trust its purpose.

Your 5-Step Checklist for a Secure Browser (This Time, for Real)

None of this requires a weekend IT project. BGR frames it as a quarterly habit—something you do after a major browser update or when something feels off. Here is a concrete, browser-agnostic checklist:

For home users, run this checklist every three months. For IT admins, push these settings via group policy and centralize exception management. The days of vague “be safe online” advice are over; these are concrete, verifiable steps that directly harden a Windows machine.

What’s Next for Browser Security

BGR’s guide lands at a pivot point. Passwords are slowly giving way to passkeys, which are phishing-resistant by design. Chrome and Edge already support them, and when combined with Windows Hello, they eliminate the attack surface that older managers worried about. Meanwhile, AI models will only become more embedded, testing the balance between convenience and autonomy.

For now, the takeaway is clear: the browsers you use every day are no longer passive windows to the web. They are active agents managing credentials, processing data, and making decisions. A five-minute audit won’t solve every problem, but as BGR makes plain, it’s the difference between a browser that works for you and one that works for someone else.