Check Chrome Extension Source Code

How to check Chrome extension source code

Short answer

To check Chrome extension source code, obtain the CRX or unpacked package, extract it, read manifest.json for entry points, then review the background worker, content scripts and bundled JavaScript. Search for remote script loads, eval-like calls, credential access and unexplained endpoints. Never run untrusted code outside a controlled environment.

Drop an extension package hereor choose a file from your deviceChoose a fileSupported: CRX, XPI, ZIP, manifest.json. Maximum size: 25 MB.

Processed locallyCode is never executed

Your file stays in this browser. Parsing happens in a Web Worker; the extension code is read, never executed.

What the scan checks

Permissions, host access, content scripts, background scripts, CSP, externally_connectable, web-accessible resources, JavaScript patterns, referenced domains and risk categories.

MV3MV2CRXXPIZIPJSON

Static analysis shows references and patterns. It cannot prove that network activity happened or that an extension is malicious.

Compare two versions

See permission, domain and finding changes between two packages.

Compare

Get the package and unpack it

Download the CRX from the store or use the extension's unpacked directory if you are the developer. A CRX is a header plus a ZIP payload. Extract it with a package inspector or a standard archive tool after stripping the header.

Keep the original package. If you later compare versions, you want the exact build you reviewed rather than a reconstructed directory.

Start with the manifest

The manifest lists permissions, host permissions, content scripts, the background or service worker, the action popup, options page, CSP and update URL. These fields tell you where the code runs and what it can reach.

Follow each entry point into the referenced files. A content script that runs on every site is more consequential than a popup script that only runs when the user clicks the toolbar icon.

Read permissions and optional_permissions
Inspect host_permissions and content_scripts.matches
Find background.service_worker or background.scripts
Check content_security_policy and update_url
Review web_accessible_resources and externally_connectable

Search for risky patterns

Search the source for remote script references, dynamic imports, eval-like calls, credential and cookie access, clipboard reads and raw IP endpoints. These are indicators, not proof of intent, and minified libraries can produce false positives.

Read the surrounding file and line for each hit. If the code is obfuscated or loaded remotely, treat the extension as harder to review and weigh that against the feature you need.

Frequently asked questions

Can I view Chrome extension source code without installing it?

Yes. Download the CRX, extract the ZIP payload and read the files locally. You do not need to load the extension in a browser profile.

Is unpacked extension code readable?

Sometimes. Many extensions ship minified or bundled code. You can still search for strings and patterns, but the original variable names and comments may be missing.

What is the most important file to review?

Start with manifest.json to map entry points, then follow the background worker and content scripts. Those files usually define the extension's persistent behavior and page access.

Does reading the source prove an extension is safe?

No. Source review can miss runtime behavior, server-side logic and future updates. It reduces uncertainty but is not a guarantee.

Last reviewed: November 1, 2026