How to Audit an Extension Before Install

How to audit an extension before install

Short answer

To audit an extension before installing, identify the publisher, obtain the package, inspect the manifest, separate API permissions from website access, review content scripts and code findings, check external domains, and compare the result with the feature you need. No single step proves safety, but together they reduce uncertainty.

Drop an extension package hereor choose a file from your deviceChoose a fileSupported: CRX, XPI, ZIP, manifest.json. Maximum size: 25 MB.

Processed locallyCode is never executed

Your file stays in this browser. Parsing happens in a Web Worker; the extension code is read, never executed.

What the scan checks

Permissions, host access, content scripts, background scripts, CSP, externally_connectable, web-accessible resources, JavaScript patterns, referenced domains and risk categories.

MV3MV2CRXXPIZIPJSON

Static analysis shows references and patterns. It cannot prove that network activity happened or that an extension is malicious.

Compare two versions

See permission, domain and finding changes between two packages.

Compare

Step 1: verify the publisher

Check the store listing for a real developer website, a support address and a privacy policy. Search for the extension name outside the store to see whether the publisher has an established presence.

Be cautious with clones, recently renamed extensions and listings that copy another product's description. Ownership changes are a known risk for popular extensions.

Step 2: inspect the package

Obtain the CRX, XPI or ZIP, then upload it to a static analyzer. Review the manifest version, required and optional permissions, host permissions and content scripts. Then read the code findings and domain list.

Use the report's file and line references to spot-check the most important findings. If a high-severity finding appears in a bundled library, note the context before drawing conclusions.

1
Identify the package
Download the exact file you would install or use an official store URL.
2
Read the manifest
Check identity, version, permissions, hosts and background configuration.
3
Review code indicators
Focus on dynamic code, remote scripts, cookies and messaging.
4
Review domains
Check analytics, advertising and unknown hosts against the privacy policy.
5
Decide and monitor
Install only if the exposure is acceptable, then re-check after updates.

Step 3: judge proportionality and transparency

The central question is proportionality: does the access match the feature? A screenshot tool may need tab capture; a calculator should not need cookies. Transparency is the second question: does the publisher explain the data clearly?

If the extension fails either test, look for an alternative or skip it. The cheapest privacy protection is not installing software you do not need.

Frequently asked questions

Do I need technical skills to audit an extension?

A static report makes the first pass accessible. Reading every line of code requires technical skill, but matching permissions to features and checking domains does not.

How long does an audit take?

A basic scan takes seconds. Reviewing the findings and comparing them with the privacy policy can take a few minutes.

Should I audit every extension update?

At least review permission changes and major versions. Smaller updates are lower risk but can still change data handling.

Last reviewed: October 31, 2026