Extension Risk Score Explained

Extension risk score explained

Short answer

An extension risk score summarizes static indicators across permissions, website access, data collection, remote code, external domains and obfuscation. It is a review aid that shows where to look, not a probability of malice. Read the category contributions and evidence before acting on the number.

Drop an extension package hereor choose a file from your deviceChoose a fileSupported: CRX, XPI, ZIP, manifest.json. Maximum size: 25 MB.

Processed locallyCode is never executed

Your file stays in this browser. Parsing happens in a Web Worker; the extension code is read, never executed.

What the scan checks

Permissions, host access, content scripts, background scripts, CSP, externally_connectable, web-accessible resources, JavaScript patterns, referenced domains and risk categories.

MV3MV2CRXXPIZIPJSON

Static analysis shows references and patterns. It cannot prove that network activity happened or that an extension is malicious.

Compare two versions

See permission, domain and finding changes between two packages.

Compare

The six weighted categories

A transparent score should show its weights and the contribution from each category. The categories separate capabilities from behavior indicators so a broad permission does not hide behind a low total.

This analyzer uses permission exposure, website access, data-collection indicators, remote-code indicators, external-domain exposure and source obfuscation. The weights are published on the methodology page and repeated in each report.

Example score categories
Category	What it looks at
Permission exposure	Sensitive API permissions and optional access
Website access	Host permissions and content-script matches
Data collection	Tracking, credential and clipboard indicators
Remote code	Remote scripts, eval-like calls and dynamic loading
External domains	Number and type of referenced domains
Obfuscation	Minification and unreadable code patterns

How to read the bands

Bands such as low, moderate, high and critical make the score easier to scan, but the boundaries are conventions, not scientific thresholds. A moderate score with one sensitive permission may deserve more attention than a high score driven by many low-risk domain references.

Always read the findings and category contributions. A score without evidence is a black box; a score with file and line references is a starting point for review.

When the score changes between versions

A score increase after an update can come from a new permission, a broader host pattern, a new domain or a new code finding. Compare the two reports to see which category moved and whether the release notes explain the change.

A score decrease does not prove that an update is safe. The new version may have removed a flagged pattern while adding a different capability that the rules do not yet cover.

Frequently asked questions

What is a good extension risk score?

There is no universal good score. A low score with narrow permissions is generally easier to justify, but the evidence and the feature you need matter more than the number.

Can I lower an extension's risk score?

Only the publisher can change the package. As a user, you can restrict site access, decline optional permissions or remove the extension.

Why do two analyzers give different scores?

They use different rules, weights, domain lists and severity mappings. Compare the categories and evidence rather than assuming one number is objective.

Is a high score automatically malicious?

No. A high score means the package has many capabilities or indicators that deserve review. Intent requires more evidence than static analysis provides.

Last reviewed: November 1, 2026

Or analyze from a store URL