Does This Extension Track Me? Signals to Check

Does this extension track me?

Short answer

You cannot prove tracking from a static scan alone. Look for combinations: analytics or advertising domains, cookie and storage access, tab or history permissions, persistent identifiers and network calls. These indicators show potential tracking. Confirming actual data collection requires runtime observation and the publisher's disclosures.

Drop an extension package hereor choose a file from your deviceChoose a fileSupported: CRX, XPI, ZIP, manifest.json. Maximum size: 25 MB.

Processed locallyCode is never executed

Your file stays in this browser. Parsing happens in a Web Worker; the extension code is read, never executed.

What the scan checks

Permissions, host access, content scripts, background scripts, CSP, externally_connectable, web-accessible resources, JavaScript patterns, referenced domains and risk categories.

MV3MV2CRXXPIZIPJSON

Static analysis shows references and patterns. It cannot prove that network activity happened or that an extension is malicious.

Compare two versions

See permission, domain and finding changes between two packages.

Compare

Tracking indicators in a package

The strongest static pattern is sensitive data access plus a destination. For example, a content script that reads cookies and the current URL and sends them to an analytics host. Each element alone may be benign; together they deserve scrutiny.

The report highlights analytics and advertising domains, cookie access, storage usage, tab and history permissions, and messaging endpoints. It also shows whether domains are unclassified.

Check the publisher's statements

A privacy policy should say what data is collected, why, where it is sent and how long it is kept. Vague wording such as 'we may collect data to improve services' is not a meaningful disclosure.

Look for a support page, a real company identity and a changelog. If the extension is monetized through ads or affiliate links, consider how that affects data collection.

Confirming behavior at runtime

Install the extension in a separate browser profile and use developer tools or a proxy to observe requests. Do not log into sensitive accounts during the test. Compare the observed hosts with the static domain list.

Runtime testing has limits too: telemetry may be delayed, conditional or disabled for new profiles. Use it as additional evidence, not absolute proof.

Frequently asked questions

Can an extension track me without analytics domains?

Yes. It could send data to an unclassified first-party host, use WebSockets or encode endpoints in configuration. Domain classification is a heuristic.

Does the analyzer see my browsing history?

No. It reads only the uploaded package and has no access to your browser profile or history.

What should I do if I suspect tracking?

Disable or remove the extension, review its privacy policy and report concerns to the store. For confirmation, observe network traffic in an isolated profile.

Last reviewed: October 31, 2026