Browser Extension Tracking Analysis

Browser extension tracking analysis

Short answer

Browser extension tracking analysis looks for combinations that could support tracking: analytics or advertising domains, cookie access, storage APIs, tab and history permissions, device identifiers and message passing. It identifies exposure and data-collection indicators, but static inspection cannot prove that tracking occurred.

Drop an extension package hereor choose a file from your deviceChoose a fileSupported: CRX, XPI, ZIP, manifest.json. Maximum size: 25 MB.

Processed locallyCode is never executed

Your file stays in this browser. Parsing happens in a Web Worker; the extension code is read, never executed.

What the scan checks

Permissions, host access, content scripts, background scripts, CSP, externally_connectable, web-accessible resources, JavaScript patterns, referenced domains and risk categories.

MV3MV2CRXXPIZIPJSON

Static analysis shows references and patterns. It cannot prove that network activity happened or that an extension is malicious.

Compare two versions

See permission, domain and finding changes between two packages.

Compare

What tracking looks like in an extension

An extension has more reach than a website tab. It can observe navigation, read page content where content scripts run, access browser APIs and persist identifiers with storage. Tracking may be first-party analytics, attribution, error reporting or something undisclosed.

The analyzer groups domain references, permission exposure and code indicators. The combination is more informative than any single signal.

Indicators the report surfaces

Relevant findings include cookie access, storage usage, network requests, analytics and advertising hosts, tab or history permissions and messaging to external pages. Each has a severity and confidence that reflects how direct the evidence is.

A network API in a bundled library is weak evidence. A content script that reads cookies, combines them with a tab URL and sends them to an analytics host is a stronger pattern, although still not proof.

Analytics and advertising domain references
Cookie, storage and identifier handling
Tab, history and webRequest permissions
Page content access through content scripts
Messaging and externally_connectable configuration

Reduce your exposure

Remove extensions you do not use, prefer narrow host access, and check permissions after updates. Use separate browser profiles for sensitive accounts if you rely on extensions with broad access. Browser privacy settings can limit some third-party storage but cannot revoke an extension's declared permissions.

Read the publisher's privacy policy and look for a clear statement of what is collected, why, where it is sent and how long it is kept. Vague policies combined with broad permissions are a warning sign.

Frequently asked questions

Can an extension track me without the tabs permission?

Yes, in some cases. Content scripts can observe the pages they match, and other APIs may reveal context. Permissions define much of the reach, but not every possible signal.

Does the analyzer see my browsing history?

No. It only reads the uploaded package. It does not access your browser profile, history, cookies or tabs.

What is the strongest tracking indicator?

A combination of sensitive data access, persistent identifiers and references to analytics or unknown hosts is stronger than any isolated domain or API reference.

Can I stop an extension from tracking me?

Remove or disable it, restrict its site access in the browser, and prefer alternatives with narrower permissions. Static analysis cannot block runtime behavior.

Last reviewed: October 31, 2026