Browser Extension Threat Scanner

Overview

Chrome extensions are a trust boundary sitting next to every tab. Broad host permissions, remote code patterns, and sensitive API use need a repeatable static check on the packages you care about, plus a diff when the zip changes.

This is a standing check for continuous security testing. You seed a demo MV3 zip (or bring your own .zip / .crx / store id), run BHUSA 2026 Arsenal ThreatXtension for permission and threat evidence, and correlate findings with a retest delta when the package changes.

It sits next to appsec graphs such as XSS Scanner. This Collection unit is the extension package path: demo seed by default; swap in your .zip / .crx or set store url/id on Scan.

Pipeline

1. Seed · Demo sensitive extension zip emits a small MV3 fixture for the smoke path.
2. Scan · ThreatXtension runs a static manifest and threat pass on that package.
3. Results · Correlate merges the scan folder into findings, inventory, remediation, and retest_delta outputs.

Inputs

• Seed extension zip. Default demo MV3 fixture. Replace with your .zip or .crx, or set store url/id on the scan node.
• LLM SAST (optional). Off by default (THREATXTENSION_SKIP_LLM). Turn it on and set Vault OpenAI / VirusTotal keys when you want those passes.

Outputs

• findings.jsonl. Permission and threat hits with remediation hints.
• inventory.jsonl. Extension packages observed in the run.
• retest_delta.jsonl. Schedule-as-diff scaffold when the package changes.

Integrations

• ThreatXtension (BHUSA 2026 Arsenal)

Sample output

Sample shape from the correlate pack on the demo zip (illustrative, not a live KPI).

kind	severity	title	note
finding	high	Broad host permission or sensitive API pattern	null
inventory	null	null	Extension package observed in the seeded run
retest_delta	null	null	Schedule re-runs when the zip or store build changes

FAQ

Does the default run pull from the Chrome Web Store?

No. The default path uses a seeded demo zip. Set Scan url or id when you want a store package.

Do I need LLM keys?

Not for the default static path. Optional LLM SAST stays off until you set vault keys and disable the skip flag.

Why schedule this?

Correlate emits retest_delta.jsonl so a scheduled re-run can surface posture change when extension packages update.

Related workflows

• XSS Scanner. Reach for this instead when the job is web reflection bugs, not extension packages.
• CICD Attack Surface Scanner. Reach for this instead when the trust boundary is Actions YAML, not a browser extension.