scan.now
Premium Scan a site

Analyse a Browser Extension's Permissions and Risk

Upload a Chrome, Edge or Firefox extension package and get a permission-by-permission risk breakdown: Host access, content scripts, remote code loading, external endpoints and the manifest settings that matter.

To get an extension's file: Use a CRX downloader for the store URL, or copy it from your browser profile's Extensions folder. Auditing extensions

Illustration of the browser extension analyzer in use

What this tool checks

9 checks across 1 areas. Each links to its reference page with the test, the risk and the fix.

Full reference

Extension permissions and behaviour

9 checks

The ones that most often decide the grade:

High Extension can read and change data on all websitesThe extension asks for access to every website, so it can read and change everything you see and type in the browser. High Extension requests high-risk permissionsThe extension requests permissions that reach beyond the page: Intercepting requests, reading cookies or history,... Critical Extension loads or evaluates remote codeThe extension fetches and executes code from a server at runtime, so what it does can change at any moment without a... High Extension code is obfuscatedThe extension's JavaScript is obfuscated rather than merely minified, which hides its behaviour from reviewers and...

After this one, most people run Browser Check, or WebRTC & IP Leak Test. Each answers a different question about the same thing, and the full list of tools explains which to reach for when. Every finding links through to the checks reference.

Guides for this tool

Background reading written to go with these results.

7 min read · Updated Sep 10, 2026 Are Browser Extensions Safe? How to Audit What You Have Installed

Extensions run with more access than any website, and a sold or hijacked extension can read everything you do. What each permission...

Read the guide 8 min read · Updated Sep 04, 2026 How Ad Blockers and Tracker Blockers Work (and Why Manifest V3 Changed Them)

A content blocker matches every request against filter lists and stops the ones that serve ads or trackers. Filter lists, cosmetic...

Read the guide 7 min read · Updated Sep 06, 2026 Automatically Deleting Cookies: Why It Cuts Tracking and How to Set It Up

Deleting cookies when you close a tab breaks the long-lived identifiers trackers depend on while keeping the sites you choose logged in....

Read the guide

Frequently asked questions

How do I get the extension file?

Download it from the store with a CRX/XPI downloader tool, or export it from your browser's extensions folder. Firefox add-ons are .xpi files; Chrome and Edge use .crx.

Is 'access to all sites' always bad?

No. An ad blocker or password manager genuinely needs it. The question is whether the extension's purpose justifies it and whether the code does anything beyond that purpose.

What is remote code?

Code the extension downloads at runtime instead of shipping in the package. It lets an author change behaviour after review, which is why Manifest V3 forbids it.