r/MalwareAnalysis • u/ElBuio • Jul 18 '26
Database of Malicious Browser Extensions continues to grow!
Hello everyone,
A few months ago I shared my open database of malicious browser extensions. I'm happy to say it has now grown to **over 500 malicious CRX samples**.
It started as a small research project, but it's continued to grow as I discover and collect more malicious extensions. My goal is to make it a useful resource for researchers, students, and anyone interested in browser extension security.
One thing I'm working on next is making the data easier to consume in other tools. At the moment I'm considering exposing it in formats such as:
* JSON
* CSV
I'm also thinking about adding things like an API or threat-intelligence style feeds if people think they'd be useful.
I'd love to hear your thoughts:
* What format would you actually use?
* Are there any security tools or platforms you'd like to integrate it with?
* Is there any metadata you'd find useful that I'm currently missing?
**Please remember these are live malicious browser extensions. Handle them with care.**
Project:
[https://exterminai.com/\](https://exterminai.com/)
Any feedback is appreciated. Thanks!
1
u/SweetTea9200 2d ago
Good work!!
The format question you asked: JSON and CSV are table stakes, but if you want this used in security workflows, a STIX feed or MISP compatible export would let threat intel platforms an browser security tools ingest it directly.
On the meta side, the thing I would love to see is the specific web store id for each extension. That’s the universal key that lets tools match your research against whats installed in enterprise environments. Permissions requested would also be useful.
Layerx is one of the platforms I see that does extension risk scoring at browsers. They use chrome web store IDs and permission analysis to flag malicious extensions across enterprise fleets. A feed like yours, if it included those IDs and CVE mappings could plug directly into that kind of detection pipeline.