Browser Add-on Data Access Checker

Browser add-on data access checker

Short answer

A browser add-on data access checker maps the extension's permissions and code references to categories of data such as cookies, browsing history, tab metadata, page content and stored values. It shows what the add-on could reach. It cannot prove that any data was read, retained or transmitted.

Drop an extension package hereor choose a file from your deviceChoose a fileSupported: CRX, XPI, ZIP, manifest.json. Maximum size: 25 MB.

Processed locallyCode is never executed

Your file stays in this browser. Parsing happens in a Web Worker; the extension code is read, never executed.

What the scan checks

Permissions, host access, content scripts, background scripts, CSP, externally_connectable, web-accessible resources, JavaScript patterns, referenced domains and risk categories.

MV3MV2CRXXPIZIPJSON

Static analysis shows references and patterns. It cannot prove that network activity happened or that an extension is malicious.

Compare two versions

See permission, domain and finding changes between two packages.

Compare

Data categories to review

Sensitive categories include cookies and session tokens, browsing history, tab URLs, page content, form fields, clipboard contents and stored identifiers. The checker groups permissions and findings by these categories so the exposure is easier to understand.

It also reports external domains, because data access matters most when paired with a transmission path.

Data access examples
Data type	Related capability	Why it matters
Cookies	cookies permission, document.cookie	Sessions can grant account access
History	history permission	Reveals interests and accounts
Tab URLs	tabs permission	Exposes browsing context
Page content	content scripts, scripting	Can read private page data
Form input	content scripts	May include credentials or messages
Storage	storage API	Can persist identifiers

Capability is not collection

A password manager can read login forms by design. An ad blocker can inspect many pages to filter content. The privacy question is whether the data is necessary, minimized, secured and disclosed.

Look for proportionality: a feature that needs one data category should not request five. Look for transparency: a privacy policy should state what is collected and why.

What to do next

Review the highest-impact permissions and the code paths that reference them. Check whether external domains are explained. If the add-on is not essential, remove it or replace it with a narrower alternative.

Frequently asked questions

Can an add-on read my passwords?

A content script on a login page may access form fields. Whether it does and whether it transmits them cannot be proven by static analysis alone.

Does the checker see my actual data?

No. It only reads the add-on package and never accesses your browser profile, cookies, history or pages.

Which data access is most sensitive?

Cookies, credentials, private page content and history are typically the most sensitive. Context and destination determine the actual risk.

Last reviewed: October 31, 2026

Or analyze from a store URL