Browser Plugin Source Analyzer

Browser plugin source analyzer

Short answer

A browser plugin source analyzer parses extension JavaScript as text and looks for static indicators such as eval, remote script loading, obfuscation, DOM injection, storage and messaging. It never executes the code. Findings show file, line, evidence and confidence so you can review the context yourself.

Drop an extension package hereor choose a file from your deviceChoose a fileSupported: CRX, XPI, ZIP, manifest.json. Maximum size: 25 MB.

Processed locallyCode is never executed

Your file stays in this browser. Parsing happens in a Web Worker; the extension code is read, never executed.

What the scan checks

Permissions, host access, content scripts, background scripts, CSP, externally_connectable, web-accessible resources, JavaScript patterns, referenced domains and risk categories.

MV3MV2CRXXPIZIPJSON

Static analysis shows references and patterns. It cannot prove that network activity happened or that an extension is malicious.

Compare two versions

See permission, domain and finding changes between two packages.

Compare

What static source analysis can find

The analyzer uses a JavaScript parser to identify calls and patterns, not only regular expressions. It reports the source location and a short evidence snippet, which makes verification practical even for nontechnical users.

It also applies lightweight obfuscation heuristics and extracts URL references for domain classification. Each finding has a severity and a confidence level.

eval and Function constructor use
External script elements and importScripts
HTML and document.write injection
Cookie, password field and keyboard access
Storage, messaging and native messaging
Obfuscation and encoded payload indicators

False positives are expected

Bundled libraries contain network calls, DOM helpers and sometimes eval-like code. Minification can look like obfuscation. The analyzer reports patterns, not intent, and confidence levels communicate uncertainty.

Use file names and line numbers to check whether a finding is in the extension's own code, a third-party library or an optional build path.

What cannot be seen

Runtime-generated code, dynamically assembled URLs and server-delivered scripts may not be visible. Static analysis is one layer of review, not a proof of behavior.

Frequently asked questions

Is source code analysis safe?

Yes when the code is parsed as text and never executed. This analyzer runs in a Web Worker and does not evaluate extension JavaScript.

Does it deobfuscate code?

No. It detects obfuscation indicators and reports them. A readable build from the publisher is easier to review.

Why are bundled libraries reported?

Libraries contain generic patterns that may look risky. File names and context help distinguish library code from the extension's own logic.

Last reviewed: October 31, 2026

Or analyze from a store URL