The fix, in one snippet
Minified is normal. Packed, encoded or self-decrypting is not.Illustrative values. Change the paths, hostnames and options to match your own site before using it.
The sections below explain what is tested, why it matters and the alternatives.
What we test
For each script the analyser separates minification (short identifiers, no whitespace, but readable strings and API names) from obfuscation: hex- or unicode-escaped identifiers and strings (\x61\x62), a string array with a rotating decoder function (the _0x1a2b pattern of javascript-obfuscator), control-flow flattening (a large switch inside while(true)), self-defending code that inspects its own toString(), eval or Function on decoded strings, the Dean Edwards packer, JSFuck, a high fraction of non-alphanumeric characters and high string entropy. Each file is reported with the signals found. Limits: aggressive compilers such as Closure's ADVANCED mode produce dense output that can resemble obfuscation, so the analyser keys on decoder patterns rather than density; embedded base64 assets and WebAssembly glue can produce false positives.
Why it matters
The Chrome Web Store has prohibited obfuscated code since 2018 precisely because reviewers could not tell what it did; minification is allowed. Nearly every malicious extension found in the wild is obfuscated, because obfuscation defeats both automated review and the researchers who look at packages afterwards. Some legitimate developers obfuscate to protect what they consider intellectual property; that still violates the policy and still prevents you from verifying what runs with access to your browsing. Every user of the extension carries the unknown.
How to fix it
Users: remove the extension and report it to the store. Prefer open-source extensions with a public repository so the package can be compared with the source. To look yourself, enable Developer mode on chrome://extensions, note the ID and open the files under the profile's Extensions folder, or load the package in CRX Viewer. The pattern to recognise:
var _0x3f2a=['\x63\x6f\x6f\x6b\x69\x65','\x66\x65\x74\x63\x68'];(function(_0x1,_0x2){…})(_0x3f2a,0x1c4);Developers: ship readable or minified code, keep source maps or a public repository, and expect obfuscated submissions to be rejected or removed. Related checks: remote code and, for files, obfuscated scripts. Guides: are browser extensions safe? and signature vs heuristic detection.
Where this fits
Extension code is obfuscated is check 3 of 9 that the browser extension analyzer runs under extension permissions and behaviour, ordered the way they are worth fixing. That ordering is the point: Fixing this one while the check above it still fails buys less than it looks like.
Fix this one first
Above it in the same category sits Extension can read and change data on all websites (high), where the extension asks for access to every website, so it can read and change everything you see and type in the browser. An attacker who has that does not need this, so it is the better use of the same hour.
What fixing this still leaves open
Extension code is obfuscated closes one route in. Immediately below it: Extension requests high-risk permissions, where the extension requests permissions that reach beyond the page: Intercepting requests, reading cookies or history, controlling downloads, talking to native programs, or debugging other tabs; Content scripts injected into every page, where the extension injects its own script into every page you open, whether or not you use it there; Extension contacts external endpoints, where the extension's code contains addresses of external servers it communicates with, so some of your data or activity may leave the browser.
The first few lines
You are a senior web engineer. I ran a security and SEO scanner against my site and it reported the finding below. Fix it properly rather than suppressing the symptom.
Finding: Extension code is obfuscated (high severity)
Scanner check id: extension-obfuscated-codeThe rest of this prompt names the pages and line numbers we found the problem on, the configuration to change, and the constraints a good answer has to respect. It is free, it just needs an account so the work is not scraped wholesale.
Sign in with GoogleSigning in is free and takes one click. We store your email address and nothing else.
References
Related guides
7 min read · Updated Sep 10, 2026
Are Browser Extensions Safe? How to Audit What You Have Installed
Extensions run with more access than any website, and a sold or hijacked extension can read everything you do. What each permission...
Read the guide
8 min read · Updated Sep 05, 2026
Signature vs Heuristic vs Behavioural Detection: How Malware Scanners Differ
Signatures catch what has been seen before; heuristics catch what looks wrong; behavioural analysis catches what acts wrong. Each...
Read the guide