---
title: "Browser Extension Threat Scanner"
canonical: https://trickest.com/library/browser-extension-threat-scanner
description: "Seed a Chrome MV3 zip into ThreatXtension, then correlate permission and threat findings you can retest."
---

# Browser Extension Threat Scanner

## Overview

Chrome extensions are a trust boundary sitting next to every tab. Broad host permissions, remote code patterns, and sensitive API use need a repeatable static check on the packages you care about, plus a diff when the zip changes.

This is a standing check for [continuous security testing](/use-cases/continuous-security-testing). You seed a demo MV3 zip (or bring your own `.zip` / `.crx` / store id), run BHUSA 2026 Arsenal ThreatXtension for permission and threat evidence, and correlate findings with a retest delta when the package changes.

It sits next to appsec graphs such as [XSS Scanner](/library/xss-scanner). This Collection unit is the extension package path: demo seed by default; swap in your `.zip` / `.crx` or set store url/id on Scan.

## Pipeline

1. Seed · Demo sensitive extension zip emits a small MV3 fixture for the smoke path.
2. Scan · ThreatXtension runs a static manifest and threat pass on that package.
3. Results · Correlate merges the scan folder into findings, inventory, remediation, and retest_delta outputs.

## Inputs

- **Seed extension zip.** Default demo MV3 fixture. Replace with your `.zip` or `.crx`, or set store url/id on the scan node.
- **LLM SAST (optional).** Off by default (`THREATXTENSION_SKIP_LLM`). Turn it on and set Vault OpenAI / VirusTotal keys when you want those passes.

## Outputs

- **findings.jsonl.** Permission and threat hits with remediation hints.
- **inventory.jsonl.** Extension packages observed in the run.
- **retest_delta.jsonl.** Schedule-as-diff scaffold when the package changes.

## Integrations

- [ThreatXtension](/tools/threatxtension) (BHUSA 2026 Arsenal)

## Sample output

Sample shape from the correlate pack on the demo zip (illustrative, not a live KPI).

```jsonl
{"kind":"finding","severity":"high","title":"Broad host permission or sensitive API pattern"}
{"kind":"inventory","note":"Extension package observed in the seeded run"}
{"kind":"retest_delta","note":"Schedule re-runs when the zip or store build changes"}
```

## FAQ

### Does the default run pull from the Chrome Web Store?

No. The default path uses a seeded demo zip. Set Scan `url` or `id` when you want a store package.

### Do I need LLM keys?

Not for the default static path. Optional LLM SAST stays off until you set vault keys and disable the skip flag.

### Why schedule this?

Correlate emits `retest_delta.jsonl` so a scheduled re-run can surface posture change when extension packages update.

## Related workflows

- [XSS Scanner](/library/xss-scanner). Reach for this instead when the job is web reflection bugs, not extension packages.
- [CICD Attack Surface Scanner](/library/cicd-attack-surface-scanner). Reach for this instead when the trust boundary is Actions YAML, not a browser extension.

---
_Markdown source of https://trickest.com/library/browser-extension-threat-scanner._