Browser extension for validating communications

A method, comprising:

• identifying, by a secure extension of a web browser and from outgoing enterprise network connections, a connection request to a remote service;
• sending, via a network based on an indication of the connection request to the remote service and by the secure extension, a Hypertext Transfer Protocol Secure (HTTPS) request to a trusted service, wherein the trusted service is different than the remote service and wherein the trusted service is identified in a configuration of the secure extension;
• receiving, by the web browser, an HTTPS response to the HTTPS request wherein the HTTP response comprises a second certificate;
• identifying, by the secure extension and based on the second certificate of the HTTPS response, operation of a middle agent based on an indication that the second certificate is different than a trusted certificate associated with the trusted service;
• and
• causing, by the secure extension and via the web browser based on an identified difference between the trusted certificate and the second certificate, display an indication that enterprise network communications are compromised by the middle agent.

One or more non-transitory computer-readable media storing instructions that, when executed by a computing device comprising a processor, memory, and a communication interface, cause the computing device to:

• identify, by a secure extension of a web browser and from outgoing enterprise network connections, a connection request to a remote service;
• send, via a network based on an indication of the connection request to the remote service and by the secure extension, a Hypertext Transfer Protocol Secure (HTTPS) request to a trusted service, wherein the trusted service is different than the remote service and wherein the trusted service is identified in a configuration of the secure extension;
• receive, by the web browser, an HTTPS response to the HTTPS request wherein the HTTP response comprises a second certificate;
• identify, by the secure extension and based on the second certificate of the HTTPS response, operation of a middle agent based on an indication that the second certificate is different than a trusted certificate associated with the trusted service;
• and
• cause, by the secure extension and via the web browser based on an identified difference between the trusted certificate and the second certificate, display an indication that enterprise network communications are compromised by the middle agent.