Our methodology
We inspect what the code does—not what the listing promises.
Permissions describe what an extension may access. ExtensionSafe also reads the published source package to find what it actually collects, changes, downloads, and sends.
How an analysis works
- Download the published package. We fetch the published CRX or XPI package directly from the Chrome Web Store or Firefox Add-ons and calculate its SHA-256 checksum.
- Read the manifest. Deterministic checks identify requested permissions, accessible websites, background services, content scripts, and externally exposed features.
- Search the source. Focused rules locate behaviors such as page tracking, form changes, cookie access, dynamic code execution, remote instructions, and data transmission.
- Investigate the evidence. Language models review the relevant code and trace what information moves from a source to a destination. They do not execute the extension.
- Write a plain-English report. A final review separates potential access from observed signs of misuse and assigns a 0–100 trust score.
What the trust score means
The score summarizes the evidence found in one published version. Broad access lowers confidence, but legitimate access alone is not treated as abuse. Hidden tracking, unexplained data sharing, remote code, credential access, or behavior that conflicts with the stated purpose carry much more weight.
A high score is not a guarantee. “Not found” means the analysis did not find evidence in the inspected package; it does not prove that a vulnerability or harmful behavior is impossible.
Safety boundaries
- Extension code is unpacked and read, never executed.
- Reports cite filenames and source lines so findings can be checked.
- Each published store version receives a permanent report; the current version also has a stable URL.
- Identical packages reuse their cached report instead of paying to analyze the same bytes again.
- We use “observed behavior” and “evidence of misuse,” not unsupported malware claims.
Found a mistake or maintain this extension? Email sam@samdelong.com with the report link and the evidence you want reviewed.