Audit Installed Chrome Extensions

How to audit installed Chrome extensions

Short answer

Auditing installed Chrome extensions starts from chrome://extensions, where you enable developer mode, review each extension's details and open its manifest and service worker. Compare permission lists, host access and external domains against the features you actually use, remove anything dormant, and compare updated packages against older builds to spot silent capability growth.

Drop an extension package hereor choose a file from your deviceChoose a fileSupported: CRX, XPI, ZIP, manifest.json. Maximum size: 25 MB.

Processed locallyCode is never executed

Your file stays in this browser. Parsing happens in a Web Worker; the extension code is read, never executed.

What the scan checks

Permissions, host access, content scripts, background scripts, CSP, externally_connectable, web-accessible resources, JavaScript patterns, referenced domains and risk categories.

MV3MV2CRXXPIZIPJSON

Static analysis shows references and patterns. It cannot prove that network activity happened or that an extension is malicious.

Compare two versions

See permission, domain and finding changes between two packages.

Compare

Inventory what you have

List every extension, including those disabled or off-managed by policy. An inactive extension usually still has permissions and can be updated by the browser, so dormant does not mean harmless.

For each item, note what it does, when you last used it and its store origin. Split the list into daily tools, occasional tools and everything else.

Open chrome://extensions and enable developer mode
Record last-used date and store origin per extension
Mark anything unused for removal

Inspect capabilities and evidence

Read manifest.json for permissions, optional permissions, host access and content scripts. Then check external domains and code indicators, which a manifest alone never shows.

Prioritize extensions that combine sensitive capabilities with vague features: continuous access to every page, credential or clipboard patterns, or endpoints that do not match the publisher.

Decide, then maintain the hygiene

Remove extensions without a clear recent purpose. For keepers, align runtime site access with the feature you use, decline optional permissions when prompted casually, and re-check after significant updates.

Repeat the audit on a schedule, such as quarterly. Extension risk is not a one-time decision: the store listing you reviewed at install time does not constrain a future update.

Frequently asked questions

How often should I audit installed extensions?

Quarterly is a reasonable default for personal use, plus an immediate review after any major update to a high-privilege extension.

Are disabled extensions safe?

They do not run content scripts while disabled, but they can still be updated and may retain permissions that apply again the moment you re-enable them.

Can I export an audit report?

With this analyzer, each package report can be exported as JSON or PDF, so you can keep dated records of what you reviewed.

How do I audit extensions managed by my organization?

Managed extensions may show a policy notice and cannot be removed. Ask your IT department for the policy list and review what data flows outside your control.

Last reviewed: November 4, 2026