extuno
Every time a Chrome extension updates, Extuno scans it again.
Extuno diffs each Chrome extension release and names the permission, script, or network change the MV3 update introduced. Every release goes through static analysis, a dynamic sandbox run, and AI review.
chrome extension
Every finding is backed by evidence.
Each finding names the change, why it is dangerous, and the recommended action.
MV3 remote code
A script loaded from an attacker host, added on this update and absent before.
Broadened host permissions
Scope jumped from a single host to all hosts in one release.
Cookie exfiltration
background.js reads document.cookie then POSTs it to an unlisted host.
A clean extension, poisoned on update
The manifest diff exposes new host permissions and a remote-code path; the sandbox captures the beacon.
- + Vulnerability and secret-leak testing on every version
- + Static analysis reads the code without running it
- + Dynamic sandbox runs it live and records behavior
- + AI code analysis reads the full source and correlates the change against prior versions
- tabs
- storage
- + host permission: *://*/*
- + scripting (remote code)
Scan your first Chrome extension free.
5 free credits on signup. One credit per scan, no card required.
Common questions
Does Extuno support Chrome?
Yes. Extuno scans Chrome with static analysis, a dynamic sandbox, and AI code analysis, and diffs every version to catch one that was clean but poisoned through an update.
How does Extuno scan Chrome?
Extuno acquires the published Chrome artifact, reads it statically with 1100+ rules, runs it in a network-segmented sandbox, reviews the source with AI, and diffs it against the prior version. The finding names the file, the change, why it is dangerous, and the fix.
What does Extuno catch in Chrome?
Leaked secrets, obfuscated or malicious code, dangerous permissions and APIs, exfiltration and command-and-control behavior, and the headline signal: a version that turns malicious after an update.