reversing-browser-extensions

Reversing Browser Extensions

A browser extension is a small privileged program wedged next to every page the user visits. Its security is almost entirely about a boundary: the content script runs beside untrusted web content but can talk to a background context that holds real permissions — cookies, tabs, the network, sometimes a native process. Reversing an extension is reading that boundary and finding where the privileged side trusts the unprivileged one.

When to Use

• Analyzing a suspicious, over-permissioned, or unknown extension's behaviour
• Auditing an extension's manifest and message-passing for privilege leaks
• Investigating how a content script exposes background/native capabilities to a page
• Recovering what an extension actually does versus what its store listing claims

When NOT to Use

• Deobfuscating the extension's bundled JavaScript as a code-reading problem — use reversing-obfuscated-javascript for the bundle, then return here for the privilege model.
• Detonating and extracting IOCs from a malicious extension as part of an incident — use analyzing-malware.
• Testing the web application the extension interacts with — testing-web-applications.
• A desktop app that happens to embed a browser — testing-thick-clients.

Get the Code and Read the Manifest

An extension ships as a CRX (Chrome) or XPI (Firefox) — both are ZIP archives; unzip and read. You can pull a published extension from the store's CRX endpoint, or straight from the browser profile's Extensions directory.

The manifest is the map. Read it before any code:

• manifest_version — MV2 (background page, webRequest blocking) vs MV3 (background service worker, declarativeNetRequest, remote code forbidden). The version changes where the privileged logic lives and how it persists.
• permissions and host_permissions — <all_urls>, tabs, cookies, webRequest, debugger, nativeMessaging, scripting. Judge each against what the extension claims to do; <all_urls> + cookies on a "dark theme" extension is the tell.
• content_scripts — which pages the extension injects into, and therefore which pages' content it is exposed to.
• externally_connectable — which web origins may send it messages directly; a permissive value is an attack surface.
• web_accessible_resources — extension files a page can load, which can leak the extension's presence or expose an injectable resource.
• content_security_policy — a loosened CSP (unsafe-eval, remote script) is a code-injection surface.