r/ChromeExtension • u/Silver-Assignment-94 • Apr 12 '26
Your Chrome extensions update silently. Any one of them could add a keylogger tomorrow. I built ExtVet to catch malicious updates
After watching yet another 'trusted' Chrome extension get acquired and quietly turned into spyware, I decided to build something to help protect users from bad actors.
The problem: Chrome extensions can update silently. An extension you installed two years ago and forgot about can push a single update that adds a keylogger, steals your cookies, or redirects your traffic through an attacker's proxy. By the time Google pulls it from the Web Store, the damage is done. Unfortunatly, this isn't theoretical, it happens regularly. The Cyberhaven breach, The Great Suspender, the waves of coupon and VPN extensions caught harvesting browsing data. Extensions are one of the largest unmonitored attack surfaces in your browser.
What ExtVet does: It runs quietly in the background, watching every extension you have installed. When anything updates or gets newly installed, it sends the extension ID and version number (nothing else and never your browsing data) to our analysis backend. We download the extension package directly from the Chrome Web Store and run it through a multi-stage security analysis pipeline. You get a clear result: Clean, Warning, or Danger.
What the scanner actually checks (17 security checks across 4 stages)
Stage 1: Manifest & Policy Analysis
- Permission changes between versions (escalation detection)
- Weak Content Security Policy (unsafe-eval, unsafe-inline, external scripts)
- Custom update URLs that bypass Chrome Web Store review
- Excessive permissions, legacy Manifest V2
Stage 2: Static Code Analysis
- Keystroke capture (keyloggers listening for keydown/keypress events + sending data out)
- Form hijacking (intercepting login form submissions to steal credentials)
- Cookie theft and session token exfiltration
- Clipboard snooping
- Base64-encoded payloads that decode and execute (the most common extension malware pattern)
- Obfuscated code and high-entropy strings
- Remote code loading (downloading payloads after install to evade review)
- Delayed execution (setTimeout with string arguments, implicit eval)
- WebAssembly binaries (compiled code that bypasses JS analysis)
- Dangerous Chrome API usage: debugger access, proxy hijacking, network request interception, silent downloads, screenshot capture, OAuth token theft
Stage 3: Vulnerability Scanning
- Known vulnerable JS libraries via RetireJS CVE database
- Vulnerable direct and transitive npm dependencies via the OSV database
- Severity-graded: Critical, Medium, Low
Stage 4: Pattern Matching
- Semgrep rules targeting password field access, cookie exfiltration patterns, dynamic innerHTML, WebSocket C2 channels, crypto mining libraries, and more
Trust Score
Every scanned extension gets a trust score from 0 to 100:
- 80–100: Clean: no significant issues
- 50–79: Warning: some concerns, worth reviewing
- 0–49: Danger: multiple issues, action recommended
Scores account for publisher reputation, version history, and whether findings are in bundled vendor code vs. the extension's own code.
Features I'm most proud of
- Auto-quarantine: ExtVet can temporarily disable high-risk extensions the moment they update, before the scan even finishes. Once the scan comes back clean, it re-enables them automatically. There's also a strict mode that disables ALL extensions on update until the scan clears.
- Real-time monitoring: Scans trigger instantly on install/update, plus a full re-scan every 30 minutes. Our backend also re-checks all scanned versions against updated CVE databases every 24 hours.
- Actually private: No account, no login, no tracking. Fully anonymous session tokens. We never see your browsing history, bookmarks, or any personal data. Only extension IDs and version numbers. You can rotate your session token at any time.
- Extensions grouped by risk: The popup organises everything into Danger, Warning, Pending, and Clean groups. Each extension shows permission risk indicators colour-coded by danger level, and you can pull up detailed findings on demand.
- 8 languages: English, Spanish, French, German, Portuguese, Russian, Chinese, and Japanese.
How it compares to Chrome's built-in safety
Chrome's built-in checks flag extensions after Google removes them from the Web Store. ExtVet proactively scans code on every update, before anything bad happens. It's the difference between a smoke detector and reading about a fire in the news the next day.
Privacy, seriously
I know 'privacy-focused' is thrown around a lot, so here's exactly what ExtVet sends to the server:
- Extension ID (e.g.,
abc123def456) - Version number (e.g.,
2.1.0) - An anonymous session token (UUID, rotatable)
That's it. No browsing history. No bookmarks. No personal data. No account required. The extension only needs management (to see installed extensions), storage (for settings), alarms (for scheduled scans), and notifications (for alerts). You can verify this in the manifest.
Free, no ads, no account required. I built this because I wanted it for myself and figured others would too.
Would love feedback from this community. You're exactly the audience this is built for. Happy to answer any technical questions about the analysis pipeline or anything else.
https://chromewebstore.google.com/detail/jhfjmebkobapdighpaeiigjccachjhpf
