Why extension updates deserve a separate check
Installing an extension is not a one-time decision. Extensions can update automatically, and an update can add permissions, content-script matches, remote endpoints or code patterns that were not present when you first reviewed the package. A version comparison turns a vague “it updated” message into a concrete list of changes.
What the comparison checks
- Added and removed API permissions, including optional permissions.
- New and removed host permissions and content-script match patterns.
- New and removed external domains, with the same category labels as a normal report.
- New and resolved code findings, including line numbers where available.
- The risk score and privacy grade before and after the update.
How to read a permission change
A new permission is a capability, not a verdict. Check the extension's release notes and the feature that needs the permission. A new cookies permission is more consequential than a new alarms permission. A new <all_urls> pattern is broader than a single host. Optional permissions are requested at runtime and can be declined.
If an update adds a broad host pattern, a raw IP endpoint or a credential-related code finding, review the report evidence before updating. When the publisher does not explain the change, consider removing the extension until it does.
Limits of a version diff
Static analysis reads the files in each package. It does not execute either version, observe runtime behavior or prove that a domain was contacted. Minified or bundled library code can create findings that are not part of the publisher's own logic. Use the diff as a focused review list, not as a malware verdict.
Frequently asked questions
How do I compare two browser extension versions?
Upload the older package on the left and the newer package on the right. The tool analyzes both locally, then shows score changes, added or removed permissions, host patterns, external domains and code findings.
Why compare extension versions instead of only scanning the latest build?
An extension can update after you install it. Comparing versions shows what changed in an update, which is useful when new permissions, domains or code patterns appear without a clear feature change.
Does a new permission in an update prove that the extension is malicious?
No. A new permission shows new capability. Review whether the update explains the feature that needs it, whether the permission is optional and whether the destination domains match the publisher's privacy policy.
Are the uploaded packages sent to a server?
No. Both packages are parsed in your browser by a Web Worker. The comparison report exists only in the page and is not uploaded.