loading
Seed a Chrome MV3 zip into ThreatXtension, then correlate permission and threat findings you can retest.
A Chrome extension zip or crx. Replace the demo seed, or mount your package.
Permission and threat findings, plus report.json.
The package is unpacked and checked for sensitive permissions and known threat patterns.
Chrome extensions are a trust boundary sitting next to every tab. Broad host permissions, remote code patterns, and sensitive API use need a repeatable static check on the packages you care about, plus a diff when the zip changes.
This is a standing check for continuous security testing. You seed a demo MV3 zip (or bring your own .zip / .crx / store id), run BHUSA 2026 Arsenal ThreatXtension for permission and threat evidence, and correlate findings with a retest delta when the package changes.
It sits next to appsec graphs such as XSS Scanner. This Collection unit is the extension package path: demo seed by default; swap in your .zip / .crx or set store url/id on Scan.
.zip or .crx, or set store url/id on the scan node.THREATXTENSION_SKIP_LLM). Turn it on and set Vault OpenAI / VirusTotal keys when you want those passes.Sample shape from the correlate pack on the demo zip (illustrative, not a live KPI).
| kind | severity | title | note |
|---|---|---|---|
| finding | high | Broad host permission or sensitive API pattern | null |
| inventory | null | null | Extension package observed in the seeded run |
| retest_delta | null | null | Schedule re-runs when the zip or store build changes |
No. The default path uses a seeded demo zip. Set Scan url or id when you want a store package.
Not for the default static path. Optional LLM SAST stays off until you set vault keys and disable the skip flag.
Correlate emits retest_delta.jsonl so a scheduled re-run can surface posture change when extension packages update.
Get a personalized demo
A 30-minute walkthrough. We map the platform to your stack and answer pricing and deployment questions for your environment.