Check What Domains a Chrome Extension Connects To

Check what domains a Chrome extension connects to

Short answer

To see which domains a Chrome extension references, extract URLs from its manifest, JavaScript, HTML and CSP. Group them as analytics, advertising, authentication, error reporting, cloud or unknown. This shows potential endpoints, not proof that the extension contacted them.

Drop an extension package hereor choose a file from your deviceChoose a fileSupported: CRX, XPI, ZIP, manifest.json. Maximum size: 25 MB.

Processed locallyCode is never executed

Your file stays in this browser. Parsing happens in a Web Worker; the extension code is read, never executed.

What the scan checks

Permissions, host access, content scripts, background scripts, CSP, externally_connectable, web-accessible resources, JavaScript patterns, referenced domains and risk categories.

MV3MV2CRXXPIZIPJSON

Static analysis shows references and patterns. It cannot prove that network activity happened or that an extension is malicious.

Compare two versions

See permission, domain and finding changes between two packages.

Compare

Static extraction versus network monitoring

Static extraction reads strings in the package. It finds hostnames even in code paths that never run, and it can miss endpoints assembled at runtime. Network monitoring observes actual requests but requires installing the extension and controlling the browser session.

Use static extraction before installation when you want a quick risk signal. Use developer tools or a proxy in a separate profile when you need to confirm behavior.

How to interpret the domain groups

Analytics and advertising hosts suggest measurement or monetization. Authentication hosts suggest sign-in flows. Error reporting hosts may receive diagnostic data. Cloud hosts can be anything from static assets to storage buckets. Unknown hosts need manual review.

Check the file and reference count for each domain. One mention in a bundled library is different from repeated references in a content script that also reads cookies or page content.

What each group may indicate
Group	Possible meaning	Follow-up
Analytics	Usage measurement	Inspect event payloads and identifiers
Advertising	Ads or attribution	Check consent and data sharing
Authentication	Login or token exchange	Review OAuth scopes and token storage
Error reporting	Crash diagnostics	Check whether page data is attached
Cloud	APIs, files, storage	Identify the account or bucket owner
Unknown	Unclassified	Read surrounding code and publisher docs

What to do with an unexpected domain

Search the source for the hostname, note the context and compare it with the privacy policy. If the domain belongs to a third party, look for a clear explanation of why it is needed.

Do not accuse an extension solely because a domain appears. Static references can be stale, optional or unrelated. Ask the publisher when the purpose is unclear.

Frequently asked questions

Can I see actual network requests in the analyzer?

No. The analyzer only reads the package. To observe real requests, install the extension in a controlled profile and use browser developer tools.

Why does an extension reference domains it never contacts?

The reference may be unused, part of a library, used only for an optional feature or kept as a fallback endpoint.

Are analytics domains always a privacy problem?

Not always, but they indicate measurement. The privacy impact depends on what data is sent, whether identifiers are used and whether the publisher discloses it.

Last reviewed: October 31, 2026