What this checker examines
The analyzer unpacks a CRX, XPI, ZIP or manifest.json file in an isolated worker and reads the package as data. It summarizes the manifest version, declared permissions, host permissions, content scripts, background scripts, externally_connectable settings, web-accessible resources and the content security policy.
It then scans JavaScript and HTML for static indicators such as eval, remote script references, storage APIs, messaging APIs, DOM injection and cookie access. Referenced domains are extracted and grouped by category.
Related pages:how to audit an extension before installare Chrome extensions safewhat a CRX package contains
Why permissions matter more than store ratings
Store ratings reflect user satisfaction, not data access. A small utility can request broad host access for a legitimate feature, while a popular extension can quietly collect more than its description suggests. The permission list is the most reliable public description of what an extension is allowed to reach.
The checker explains each permission and separates website access from API access. That distinction helps you see whether an extension can read every page you visit or only a specific service.
Related pages:how to check Chrome extension permissionswhat does the all_urls permission mean
How to read the risk score
The 0-100 score combines six categories with fixed weights: permission exposure, website access, data collection indicators, remote code indicators, external domain exposure and obfuscation. Every category shows its evidence and contribution.
A high score is a prompt to investigate, not a malware verdict. Legitimate debugging tools, password managers and accessibility extensions often score higher because they need powerful capabilities. A low score cannot guarantee safety either, because static analysis sees references rather than runtime behavior.
Related pages:does this extension track mebest extension permission checker toolsextension risk score explainedChrome extension safety check
What static analysis cannot prove
Static inspection cannot show whether a network request actually happened, whether a server returned code that was later executed, or whether a permission was used against your account. Code loaded remotely after installation may never appear in the package you scanned.
Use the report together with the publisher's identity, the store listing, the extension's update history and your own tolerance for risk. If you are unsure, disable the extension when you do not need it.
Related pages:browser extension malware scannerChrome extension safety check