Extension Content Script Inspector

Extension content script inspector

Short answer

A content script inspector shows which websites an extension injects code into and when. It reads content_scripts entries in the manifest, explains match patterns, run_at timing and all_frames behavior, and links the scripts to static code findings. Content scripts can read and change the pages they match.

Drop an extension package hereor choose a file from your deviceChoose a fileSupported: CRX, XPI, ZIP, manifest.json. Maximum size: 25 MB.

Processed locallyCode is never executed

Your file stays in this browser. Parsing happens in a Web Worker; the extension code is read, never executed.

What the scan checks

Permissions, host access, content scripts, background scripts, CSP, externally_connectable, web-accessible resources, JavaScript patterns, referenced domains and risk categories.

MV3MV2CRXXPIZIPJSON

Static analysis shows references and patterns. It cannot prove that network activity happened or that an extension is malicious.

Compare two versions

See permission, domain and finding changes between two packages.

Compare

What a content script can do

Content scripts share the page's DOM but run in an isolated JavaScript world by default. They can read and modify page content, observe user input and communicate with the extension's background context.

The match patterns decide where this happens. A pattern for one domain is narrow; patterns with wildcard schemes or all_urls are broad and deserve attention.

Reading match patterns

A match pattern has a scheme, host and path. https://example.com/* matches pages on that host. https://*.example.com/* includes subdomains. <all_urls> covers every supported scheme and host.

The inspector separates content-script matches from host_permissions, because injection access and API access are related but not identical. It also reports run_at and all_frames when declared.

Questions to ask about injected scripts

Does the feature need to run on every page or only on the sites it lists? Does the script read forms, cookies or messages? Does it inject HTML or load remote code? Does it send page content to a server?

The report answers what can be observed statically. It does not claim that page data was collected. For extensions that handle sensitive accounts, prefer narrow matches and visible, documented behavior.

1
Identify the match patterns
List every host or wildcard the content script targets.
2
Check the timing
document_start runs earlier than document_idle and may see different page state.
3
Review frame behavior
all_frames extends injection into embedded frames.
4
Inspect the script
Use the linked findings and file names to review data access.

Frequently asked questions

What is a content script?

A file an extension injects into matching web pages. It can read and change the page DOM and communicate with the rest of the extension.

Does a content script run on every website?

Only where its match patterns apply. Patterns such as all_urls or wildcard schemes can cover nearly every site.

What does all_frames mean?

It allows the content script to run inside iframes that match the pattern, not only the top-level page.

Can content scripts read cookies?

Page scripts cannot normally read HttpOnly cookies. Content scripts may access document.cookie where cookies are not HttpOnly, and an extension with the cookies permission can use the cookie API.

Last reviewed: October 31, 2026