You installed an extension three years ago. It does one small thing well, it has a few hundred thousand users, and you forgot it exists.
Then the developer sells it.
The buyer pushes an update. Chrome installs it silently in the background, like every update. The extension already has permission to read every page you visit, because it always had. Now it uses it: affiliate redirects, injected ads, or quietly shipping your browsing history somewhere.
This isn't hypothetical. It has happened many times to popular extensions, and the pattern is always the same. Nothing in Chrome tells you that the person behind an extension changed.
So I built Extension Guardian. It's free and open source. This post is about how it works and the one annoying problem I didn't expect.
What it watches for
Four signals catch most bad cases:
- The developer changed. The Chrome Web Store shows who offers each extension. If that name or email changes, the extension was probably sold.
- An update added permissions. Going from "read data on example.com" to "read data on all websites" deserves a warning.
- It vanished from the store. When Google finds malware, it usually removes the listing. Your installed copy keeps running, and nobody tells you.
- It came from outside the store. Extensions installed by another program or updating from a non-Google server are a classic adware trick.
Access is not risk
My first version had a problem: it rated almost everything "high". A password manager, an ad blocker and a grammar checker all need to read every page, because that's their job.
So every extension gets two separate ratings:
- Access: what its permissions technically allow (full, limited, basic).
- Risk: whether you should trust it.
Risk combines the warnings above with signals from the store page. Few users and no updates in two years raise it. A large user base, recent updates and a registered business lower it. Critical signals, like an owner change or removal from the store, always mean high risk, no matter how popular the extension is.
The scoring looks roughly like this:
score = critical * 40 + firm + Math.max(0, soft - good);
level = critical > 0 ? 'high' : score >= 40 ? 'high' : score >= 15 ? 'watch' : 'low';
"Soft" signals, like few users, can be offset by good ones. A recent jump in permissions is "firm" and can't be talked down by a big install count, because a big install count is exactly what a buyer pays for.
The surprise: extensions can't read the Chrome Web Store
The developer info lives on the public store page, so the plan was simple: fetch chromewebstore.google.com/detail/<id> from the extension and parse it.
Chrome blocks that. Extensions can't script or fetch the Web Store, even with host permissions. It's a deliberate protection, so a malicious extension can't install or review other extensions.
The fix is a tiny server. A Cloudflare Worker fetches the public page, extracts the developer name, email, user count and last update date, and returns JSON. Results are cached in Workers KV for 6 hours, so the store is hit rarely.
The extension sends only extension IDs, nothing about the user. IDs are public 32-letter identifiers, the same ones in every store URL. The server allows any origin through CORS, so the extension doesn't even need a host permission for it, and Chrome shows no extra install warning.
Parsing a page with no API
There's no official Web Store API for this, so the server parses HTML, which can break whenever Google changes the layout. Two safeguards:
- Fixtures of real store pages in the tests, so a layout change shows up as a failing test, not as wrong data.
- If more than half of a user's extensions suddenly come back "not found", the extension assumes the parser broke and doesn't raise removal alerts. A false "removed from store" alert on every extension would be worse than no alert.
Try it
It's early, so the most useful feedback is false alarms: an extension you trust that it flags as risky, and why you trust it. Tuning those signals is most of the work.
Top comments (0)