Chrome Extension Safety Check

Chrome extension safety check

Short answer

A Chrome extension safety check reviews the package's permissions, host access, content scripts, code indicators, external domains and update behavior. It shows what the extension is capable of and flags suspicious patterns, but it cannot prove intent or observe runtime activity. Use it with store review, publisher history and a privacy policy review.

Drop an extension package hereor choose a file from your deviceChoose a fileSupported: CRX, XPI, ZIP, manifest.json. Maximum size: 25 MB.

Processed locallyCode is never executed

Your file stays in this browser. Parsing happens in a Web Worker; the extension code is read, never executed.

What the scan checks

Permissions, host access, content scripts, background scripts, CSP, externally_connectable, web-accessible resources, JavaScript patterns, referenced domains and risk categories.

MV3MV2CRXXPIZIPJSON

Static analysis shows references and patterns. It cannot prove that network activity happened or that an extension is malicious.

Compare two versions

See permission, domain and finding changes between two packages.

Compare

What a safety check can tell you

A package-level check reads manifest.json and the files inside the extension. It can separate API permissions from website access, list content-script match patterns, show background or service-worker entry points and identify external domains referenced in the code.

Static rules can also flag dynamic code execution, remote script references, obfuscation, credential access and other patterns that deserve a closer look. Each finding should include the file, line and matched evidence so the result can be verified.

Required and optional API permissions
Host permissions and content-script matches
Remote code and dynamic execution indicators
External domains and their categories
Manifest fields such as CSP and externally_connectable

What it cannot tell you

A static check does not execute the extension, so it cannot observe network requests, DOM changes, user interactions or behavior that only appears after a delay. It also cannot prove that a referenced domain was contacted or that a permission was used.

Bundled libraries and minified code can create findings that are not part of the publisher's own logic. Read the surrounding code before treating a pattern as evidence of intent. Store review and runtime testing answer different questions.

A practical safety checklist

Start with the permissions and host access. Ask whether each capability is proportionate to the feature you need. Then review content scripts, external domains and code findings. Finally, check the publisher, the privacy policy and the update history.

If an update adds a broad host pattern, a sensitive API permission or an unexplained endpoint, review the evidence before accepting it. When the publisher does not explain the change, remove the extension until it does.

Does the extension need all_urls or only specific sites?
Are optional permissions requested only when needed?
Do external domains match the publisher and feature?
Are there remote script references or eval-like calls?
Does the privacy policy explain data collection and retention?

Frequently asked questions

Is a Chrome extension safety check enough before installing?

No single check is enough. Combine the package report with the publisher's reputation, the privacy policy, the store listing and your own risk tolerance.

Can a safety check detect malware?

It can flag static indicators associated with malicious or risky behavior, but it cannot prove malware. Runtime analysis and threat intelligence answer different questions.

Why do bundled libraries create findings?

Minified dependencies can contain patterns such as dynamic code construction or network calls that are normal for the library but look suspicious out of context.

What should I check after an extension updates?

Compare permissions, host patterns, external domains and code findings with the previous version. Review any new capability that the release notes do not explain.

Last reviewed: November 1, 2026