Narrow and explainable
Requested permissions and host access appear proportionate to the extension's visible purpose.
Analyse a Browser Extension's Permissions and Risk
Upload a Chrome, Edge or Firefox extension package and get a permission-by-permission risk breakdown: Host access, content scripts, remote code loading, external endpoints and the manifest settings that matter.
To get an extension's file: Use a CRX downloader for the store URL, or copy it from your browser profile's Extensions folder. Auditing extensions
Reading the package…
What this tool checks
9 checks across 1 areas. Each links to its reference page with the test, the risk and the fix.
Extension permissions and behaviour
9 checksThe ones that most often decide the grade:
High
Extension can read and change data on all websitesThe extension asks for access to every website, so it can read and change everything you see and type in the browser.
High
Extension requests high-risk permissionsThe extension requests permissions that reach beyond the page: Intercepting requests, reading cookies or history,...
Critical
Extension loads or evaluates remote codeThe extension fetches and executes code from a server at runtime, so what it does can change at any moment without a...
High
Extension code is obfuscatedThe extension's JavaScript is obfuscated rather than merely minified, which hides its behaviour from reviewers and...
Medium
Content scripts injected into every pageThe extension injects its own script into every page you open, whether or not you use it there.
Medium
Extension contacts external endpointsThe extension's code contains addresses of external servers it communicates with, so some of your data or activity...
Medium
Extension weakens its Content-Security-PolicyThe extension's content_security_policy loosens the default protections, permitting inline scripts, eval or remote...
Low
Extension uses Manifest V2The extension still declares manifest_version 2, a format Chrome no longer runs and that lacks the stricter code and...
Info
Extension declares optional permissionsThe extension declares optional permissions or optional host permissions that it can request later at runtime. This...
What a browser extension risk analysis examines
The analyzer connects manifest permissions with the code and network access packaged inside a Chrome, Edge or Firefox extension.
Browser extensions can read and modify pages with privileges ordinary websites do not have. A permission is not automatically malicious, but its scope should match the extension's purpose. A colour picker should not normally need access to every website, browsing history and downloads.
Scan.now unpacks the CRX, XPI or ZIP within strict archive limits, reads the manifest, maps permissions to plain-language capabilities and reviews content scripts, host patterns, externally reachable resources and references to remote code or network endpoints. The package is analysed statically and is never installed or executed.
Open the packageValidate and unpack the extension inside bounded archive limits.
Map capabilitiesRead the manifest, permissions, host access and content-script scope.
Review code cluesInventory remote endpoints, risky APIs and remotely supplied behaviour.
Put this result in context
This scanner answers one part of the review. Continue with Browser Check for fingerprint, leaks, version, policies, then WebRTC & IP Leak Test for real ip exposure behind a vpn. These are separate checks because a strong result here does not prove that the adjacent surface is healthy.
For the background behind these signals, read Are Browser Extensions Safe? How to Audit What You Have Installed and How Ad Blockers and Tracker Blockers Work (and Why Manifest V3 Changed Them). The Extension can read and change data on all websites check reference explains the exact test, evidence and remediation used in the report. The Scan.now methodology explains request limits, scan boundaries and what the scanner deliberately does not attempt.
Browser extension risk areas
Risk comes from the combination of permission breadth, where code runs and what that code can communicate with.
| Area | What is inspected | Why reviewers care |
|---|---|---|
| Permissions | Named browser capabilities such as tabs, history, downloads, cookies and webRequest. | Powerful APIs can expose browsing data or modify traffic. |
| Host access | Exact sites, wildcard domains and all-URLs patterns. | Broad access lets content scripts read or change many pages. |
| Content scripts | Match patterns, run timing, frames and JavaScript injected into pages. | Shows where extension code enters the page context. |
| Remote behaviour | External script references, dynamic code patterns and remotely hosted resources. | Behaviour changed outside the reviewed package can bypass normal release review. |
| Network endpoints | Public hosts and URLs referenced in manifest and supported source files. | Reveals analytics, update, API and data-transfer destinations for manual review. |
How to interpret extension risk
The analyzer reports capability and evidence, not an accusation about the developer's intent.
High-impact capability
Broad page access combined with sensitive APIs, dynamic code or unexplained endpoints deserves close review before installation.
Powerful but expected
Password managers, blockers and developer tools often need broad access. Trust, maintenance and code provenance still matter.
Review an extension before installing it
- Compare each permission with a feature you intentionally need.
- Prefer actively maintained extensions from a verifiable publisher with a clear privacy policy.
- Restrict site access to on-click or selected domains when the browser supports it.
- Reanalyse major updates because permissions and remote endpoints can change between versions.
What this result does not prove
- Static analysis does not run the extension, observe encrypted traffic or prove what a remote server does with data.
- Minified, generated or obfuscated code can make intent difficult to determine from package evidence alone.
- A low-risk manifest does not prove that the publisher, update channel or future version is trustworthy.
Related tools
Continue the review with four checks that cover adjacent parts of the same attack surface.
Browser Security & Privacy Check
Fingerprint, leaks, version, policies
WebRTC & IP Leak Test
Real IP exposure behind a VPN
Password Strength & Breach Checker
Breach lookup and strength analysis
Phishing URL Checker
Lookalike domains and hidden redirects
Guides for this tool
Background reading written to go with these results.
7 min read · Updated Sep 10, 2026
Are Browser Extensions Safe? How to Audit What You Have Installed
Extensions run with more access than any website, and a sold or hijacked extension can read everything you do. What each permission...
Read the guide
8 min read · Updated Sep 04, 2026
How Ad Blockers and Tracker Blockers Work (and Why Manifest V3 Changed Them)
A content blocker matches every request against filter lists and stops the ones that serve ads or trackers. Filter lists, cosmetic...
Read the guide
7 min read · Updated Sep 06, 2026
Automatically Deleting Cookies: Why It Cuts Tracking and How to Set It Up
Deleting cookies when you close a tab breaks the long-lived identifiers trackers depend on while keeping the sites you choose logged in....
Read the guideFrequently asked questions
How do I get the extension file?
Download it from the store with a CRX/XPI downloader tool, or export it from your browser's extensions folder. Firefox add-ons are .xpi files; Chrome and Edge use .crx.
Is 'access to all sites' always bad?
No. An ad blocker or password manager genuinely needs it. The question is whether the extension's purpose justifies it and whether the code does anything beyond that purpose.
What is remote code?
Code the extension downloads at runtime instead of shipping in the package. It lets an author change behaviour after review, which is why Manifest V3 forbids it.
