AI 产品解读Browser extension security scanner
Helps users identify potentially malicious or risky installed browser extensions by analyzing their permissions, install source, and cross-referencing against a known malicious extension blocklist.
User clicks 'Scan Extensions' in the popup → background service worker retrieves installed extensions via chrome.management → checks each against the malicious blocklist (remote then local fallback) and Chrome Web Store presence → analyzes permissions and host access → calculates risk score → displays results in popup with Safe/Warning/Danger badges and detailed reasons
Permission analysis — detects dangerous/sensitive permissions (debugger, cookies, clipboardRead, etc.) and broad host access patternsInstall type checks — flags sideloaded and developer-mode extensions not from Chrome Web StoreMalicious ID blocklist — cross-references extensions against a bundled/remote list of known malicious IDs with reasonsRisk scoring — assigns Safe/Warning/Danger levels with composite scoresAuto-updating blocklist — fetches latest malicious extension list from GitHub Pages on scan
- 目标用户
- Chrome users concerned about browser extension security / Privacy-conscious users / IT administrators managing browser extensions
- Blocklist data is hosted on a personal GitHub Pages account (halkichi0308.github.io), which may not be as reliable or frequently updated as a dedicated security service. The extension relies on this single external source for threat intelligence. No offline mode is explicitly tested. The extension only scans extensions installed in the current browser profile.
付费分析未识别到付费功能
The extension is completely free with no paid features, subscription gates, or billing logic. All features (permission analysis, blocklist checking, risk scoring, install type checks) are available without payment. The README references an MIT license, and the Web Store listing shows no premium tier or upgrade prompts.
- 置信度
- 100
- 支付平台
- --
- 来源
- AI / 高
- 需要登录
- 否
- 登录理由
- The extension operates entirely locally. It uses the chrome.management API to scan installed extensions and performs risk analysis client-side. It fetches a blocklist from a public GitHub Pages URL and checks extension presence against the Chrome Web Store update endpoint, neither of which requires user authentication. The popup UI has no login form or account integration.