Safari Web Extension Privacy Check

Safari web extension privacy check

Short answer

A Safari web extension privacy check inspects the WebExtension manifest bundled inside the app extension resources. Safari uses the same manifest model as Chrome, so permissions, host access and content scripts are comparable across browsers. The check shows declared capabilities and static indicators; it cannot observe what the extension does at runtime or prove that a permission was used.

Drop an extension package hereor choose a file from your deviceChoose a fileSupported: CRX, XPI, ZIP, manifest.json. Maximum size: 25 MB.

Processed locallyCode is never executed

Your file stays in this browser. Parsing happens in a Web Worker; the extension code is read, never executed.

What the scan checks

Permissions, host access, content scripts, background scripts, CSP, externally_connectable, web-accessible resources, JavaScript patterns, referenced domains and risk categories.

MV3MV2CRXXPIZIPJSON

Static analysis shows references and patterns. It cannot prove that network activity happened or that an extension is malicious.

Compare two versions

See permission, domain and finding changes between two packages.

Compare

Where the manifest lives

A Safari web extension is shipped inside an app bundle. The extension resources folder contains manifest.json, the JavaScript bundles and the icon and locale files, following the same WebExtensions conventions as Chrome and Firefox.

On macOS, the App Store review layer can add a review trail, but the review focuses on store policy, not on a semantic promise that the extension never reads page content.

What the check covers

Treat it like any browser extension: read the manifest, compare requested permissions with the feature, look at content script patterns, then check code indicators such as remote script references or obfuscation.

Safari-specific details matter at the edges: some APIs are unavailable or named differently, and the same genuine capability in a manifest may work differently on this platform.

Permissions and optional permissions
Host access and content script matches
External domains and remote script references
Update behavior and publisher pairing

Practical limits

App Store badges and signed builds answer who distributed the package, not what it can access or who funded it. The package and publisher remain the two main evidence sources.

Compare manifest versions across the app history when the extension updates. A capability growth inside an app bundle can be as quiet as any other store update.

Frequently asked questions

Can I check a Safari extension without installing the app?

Usually yes. The extension resources live inside the app bundle, so you can inspect its manifest and code locally without installing or enabling the extension.

Is a Mac App Store extension safer?

Not automatically. Review checks policy and distribution; privacy depends on what the extension's manifest and code actually access.

Do Safari extensions use CRX files?

No. Safari web extensions use standard WebExtension folders inside an app bundle rather than CRX files, though the manifest format is familiar.

How does the privacy check differ from Chrome?

The method is the same static review. API availability and platform defaults differ, so compare the manifest fields this browser honors.

Last reviewed: November 4, 2026