Edge Extension Permission Checker

Edge extension permission checker

Short answer

An Edge extension permission checker inspects the add-on package for API permissions, host access, content scripts, external domains and code indicators. Edge add-ons use the Chromium extension model, so the manifest fields are familiar. The checker shows capability and static risk signals, not proof of runtime behavior.

Drop an extension package hereor choose a file from your deviceChoose a fileSupported: CRX, XPI, ZIP, manifest.json. Maximum size: 25 MB.

Processed locallyCode is never executed

Your file stays in this browser. Parsing happens in a Web Worker; the extension code is read, never executed.

What the scan checks

Permissions, host access, content scripts, background scripts, CSP, externally_connectable, web-accessible resources, JavaScript patterns, referenced domains and risk categories.

MV3MV2CRXXPIZIPJSON

Static analysis shows references and patterns. It cannot prove that network activity happened or that an extension is malicious.

Compare two versions

See permission, domain and finding changes between two packages.

Compare

Edge add-ons use the Chromium model

Microsoft Edge supports Chromium extensions, so manifest.json fields such as permissions, host_permissions, content_scripts, background and action work in the same way as Chrome. API support can differ at the edges, but the permission review process is familiar.

An Edge add-on package can be inspected as a CRX or ZIP. The store page and the add-on details page summarize access, but the manifest is more precise.

What to compare

Review required and optional permissions, host patterns and content-script matches together. A permission such as debugger or nativeMessaging is more consequential than storage, and an all-sites pattern is broader than a single host.

Check external domains and code findings as well. A new endpoint or a remote script reference in an update deserves a closer look even when the permission list is unchanged.

Permission review priorities
Area	What to ask
API permissions	Does the feature need this capability?
Host access	Does it need every site or specific sites?
Content scripts	Where does the code run?
External domains	Do endpoints match the publisher?
Code findings	Are there remote or dynamic code patterns?

Before you install or update

Compare the new package with the version you already reviewed. Look for new permissions, broader host access, new domains and new code findings. If the release notes do not explain a change, ask the publisher or wait.

Store review and the Edge Add-ons badge are useful signals, but they are not a guarantee about privacy or future updates.

Frequently asked questions

Can I use a Chrome extension checker for Edge add-ons?

Often yes, because Edge uses the Chromium extension model. Confirm that the tool supports the package format and the manifest version you are reviewing.

How do I see an Edge add-on's permissions?

Open the add-on details page in Edge or inspect manifest.json from the package. The manifest is more complete and shows optional and host permissions separately.

Are Edge add-ons reviewed by Microsoft?

Microsoft reviews add-ons for its store, but review is not a guarantee of privacy or future behavior. Inspect the package and publisher yourself.

What is the riskiest Edge extension permission?

There is no single riskiest permission. Debugger, nativeMessaging, proxy, cookies and broad host access are all high-impact depending on the feature.

Last reviewed: November 1, 2026