The fix, in one snippet
chrome://extensions > Details > Inspect views: Service worker > NetworkIllustrative values. Change the paths, hostnames and options to match your own site before using it.
The sections below explain what is tested, why it matters and the alternatives.
What we test
The analyser extracts every http(s):// and ws(s):// literal from the package's JavaScript, HTML and JSON, drops documentation links in comments, and groups the rest by host. Each host is classified: the developer's own homepage_url domain (expected), analytics and crash-reporting services (Google Analytics, Mixpanel, Sentry, Amplitude, Segment), advertising and affiliate networks, raw IP addresses, dynamic-DNS and free hosting, and URL shorteners; and by use, whether the host appears in fetch, XMLHttpRequest, WebSocket or sendBeacon calls or only in links. Limits: hosts assembled at runtime from fragments are missed; a listed host proves nothing was sent; the extension is not run and its traffic is not observed. A weather extension calling a weather API is expected.
Why it matters
An extension can transmit your browsing history, page contents or identifiers to a server. Chrome Web Store policy requires disclosure and limits use, but enforcement follows discovery. The 2019 DataSpii research documented extensions uploading full URLs, including links to private documents and tokens, to a third-party analytics buyer. Analytics libraries inside extensions routinely include the current page URL in their events. An endpoint on a raw IP or free hosting, with no privacy policy, is a strong warning. Other extensions cannot block traffic an extension sends from its own background context, so an ad blocker does not help here; only a system firewall or DNS filter sees it.
How to fix it
Users: read the Privacy practices section of the store listing and the linked privacy policy; the endpoints in the report should be explained there. Prefer extensions that work offline. Watch the traffic with a system-level tool (Little Snitch, LuLu, Pi-hole) if you need certainty. Remove anything that contacts an unexplained host.
Developers: document every endpoint in the listing, make telemetry opt-in, never send page URLs or contents, and keep the endpoint list short and stable. Related checks: remote code and all-URL content scripts. Guides: are browser extensions safe? and how online tracking works.
Where this fits
Extension contacts external endpoints is check 6 of 9 that the browser extension analyzer runs under extension permissions and behaviour, ordered the way they are worth fixing. That ordering is the point: Fixing this one while the check above it still fails buys less than it looks like.
Fix this one first
Above it in the same category sits Content scripts injected into every page (medium), where the extension injects its own script into every page you open, whether or not you use it there. An attacker who has that does not need this, so it is the better use of the same hour.
What fixing this still leaves open
Extension contacts external endpoints closes one route in. Immediately below it: Extension weakens its Content-Security-Policy, where the extension's content_security_policy loosens the default protections, permitting inline scripts, eval or remote scripts inside the extension's own pages; Extension uses Manifest V2, where the extension still declares manifest_version 2, a format Chrome no longer runs and that lacks the stricter code and policy rules of Manifest V3; Extension declares optional permissions, where the extension declares optional permissions or optional host permissions that it can request later at runtime.
The first few lines
You are a senior web engineer. I ran a security and SEO scanner against my site and it reported the finding below. Fix it properly rather than suppressing the symptom.
Finding: Extension contacts external endpoints (medium severity)
Scanner check id: extension-external-endpointsThe rest of this prompt names the pages and line numbers we found the problem on, the configuration to change, and the constraints a good answer has to respect. It is free, it just needs an account so the work is not scraped wholesale.
Sign in with GoogleSigning in is free and takes one click. We store your email address and nothing else.
References
Related guides
7 min read · Updated Sep 10, 2026
Are Browser Extensions Safe? How to Audit What You Have Installed
Extensions run with more access than any website, and a sold or hijacked extension can read everything you do. What each permission...
Read the guide
8 min read · Updated Sep 02, 2026
How Online Tracking Works: Cookies, Pixels, Fingerprints and Data Brokers
Tracking is the business of linking your visits across sites into a profile. Each technique from third-party cookies to fingerprinting...
Read the guide