Add-on Permission Scanner

Add-on permission scanner

Short answer

An add-on permission scanner extracts declared permissions from a browser extension package and explains what each one allows. It covers Chrome, Edge and Firefox packages, separates required from optional access, and highlights broad host access and high-impact browser APIs.

Drop an extension package hereor choose a file from your deviceChoose a fileSupported: CRX, XPI, ZIP, manifest.json. Maximum size: 25 MB.

Processed locallyCode is never executed

Your file stays in this browser. Parsing happens in a Web Worker; the extension code is read, never executed.

What the scan checks

Permissions, host access, content scripts, background scripts, CSP, externally_connectable, web-accessible resources, JavaScript patterns, referenced domains and risk categories.

MV3MV2CRXXPIZIPJSON

Static analysis shows references and patterns. It cannot prove that network activity happened or that an extension is malicious.

Compare two versions

See permission, domain and finding changes between two packages.

Compare

What makes this scanner different

It reads the package rather than the store summary. That means it can show the exact host patterns, optional permissions and manifest version, including fields the install prompt compresses into a short warning.

It also reports related code references. A permission tells you what is possible; code findings help you see where related APIs appear.

A quick triage method

Sort permissions into three buckets: expected for the feature, plausible but unexplained, and inconsistent with the product. Investigate the third bucket first. Then check whether host access is limited to the sites the product touches.

Review optional permissions separately. They can appear after installation and may be the moment when access expands.

Limits of a permission scan

A scanner cannot prove that a permission is used or abused. It cannot see runtime data flows or remote code. Use the scan to focus your review, not to replace it.

Frequently asked questions

Does the scanner work for Firefox add-ons?

Yes. Upload an XPI or use a supported addons.mozilla.org URL. Manifest permissions and host access are analyzed in the same way.

Does it scan optional permissions?

Yes, and they are labelled separately so you can see what may be requested later.

Is a permission scanner enough for a security audit?

No. It is a focused static review. A full audit needs code review and, for behavior, runtime observation.

Last reviewed: October 31, 2026

Or analyze from a store URL