Edge Extension Inspector

Edge extension inspector

Short answer

An Edge extension inspector analyzes a Microsoft Edge add-on package using the same Manifest V3 model as Chromium. It shows declared permissions, host access, background configuration, content scripts and code indicators, helping you compare an add-on's capabilities with its stated purpose.

Drop an extension package hereor choose a file from your deviceChoose a fileSupported: CRX, XPI, ZIP, manifest.json. Maximum size: 25 MB.

Processed locallyCode is never executed

Your file stays in this browser. Parsing happens in a Web Worker; the extension code is read, never executed.

What the scan checks

Permissions, host access, content scripts, background scripts, CSP, externally_connectable, web-accessible resources, JavaScript patterns, referenced domains and risk categories.

MV3MV2CRXXPIZIPJSON

Static analysis shows references and patterns. It cannot prove that network activity happened or that an extension is malicious.

Compare two versions

See permission, domain and finding changes between two packages.

Compare

Edge add-ons use Chromium manifests

Microsoft Edge Add-ons are packaged as CRX files and use the same extension platform as Chrome, with some API differences. Most Manifest V3 permissions and host permissions mean the same thing in both browsers.

The report lists browser compatibility based on the manifest and background configuration. Compatibility is a technical observation, not a store endorsement.

What to review first

Start with host permissions and content scripts. These decide which pages the extension can read or modify. Then review sensitive API permissions such as debugger, cookies, history, management, proxy and nativeMessaging.

The code findings help you see dynamic execution, remote script references, DOM injection, storage and messaging. Each finding includes a file and line where available.

Broad host access and all_urls
Content-script match patterns
Background service worker and update URL
Externally connectable origins
Dynamic code and remote script references

Manual upload and store limits

The inspector tries official retrieval when you paste a Microsoft Edge Add-ons URL. If the store blocks the request, download the package from the store and upload it manually.

The analyzer does not bypass authentication, region restrictions or store controls. It only reads the file you provide or the package returned by an approved endpoint.

Frequently asked questions

Can I inspect an Edge add-on before installing it?

Yes. Paste the Edge Add-ons URL or upload the CRX file. The package is parsed in your browser without installation.

Are Edge permissions the same as Chrome permissions?

Most Manifest V3 permissions share the same names and meaning. Some APIs and policies differ, and availability can change between browser versions.

Why does the store URL fail?

The store may block automated downloads or return an HTML page. Download the package from the store and upload the file instead.

Does a high score mean an Edge add-on is malicious?

No. The score measures exposure and static indicators. A high score means investigate carefully; it is not a malware classification.

Last reviewed: October 31, 2026

Or analyze from a store URL