DEV Community

Mr Zack
Mr Zack

Posted on

Your browser extensions can read every site you visit. Auditing 200 of them takes one scrape

A Chrome extension with <all_urls> host access can read your banking session, your email, your internal admin panels — every page you open. Most orgs have no idea which of the extensions their people installed request that level of access. The Chrome Web Store won't tell you in bulk: permission info lives inside each extension's manifest, one listing at a time.

I kept seeing the same manual workflow: a security reviewer opens 40 extension pages, clicks through to the details, squints at the permission list, pastes findings into a sheet. Next quarter, repeat, because versions and permissions changed.

That's a scraping problem, so I built Chrome Web Store Intelligence & Permission-Risk Scraper — it turns any list of extensions, search queries, or whole categories into structured rows with a documented 0–100 permission-risk score. $2.40 per 1,000 extensions, HTTP-only, no login, no API key.

What you get per extension

One row per extension with the fields a review actually needs:

Field Example
name / extensionId uBlock Origin / cjpalhdl…
rating / ratingCount / userCount 4.7 / 35450 / 11000000
version / lastUpdatedDays / isAbandoned 1.74.0 / 0.3 / false
apiPermissions ["scripting","tabs","cookies"]
hostPermissions ["https://*/*"]
permissionRiskScore 86
riskLevel critical
riskFlags ["broad_host_access","reads_cookies"]

The risk model is transparent: broad host access (<all_urls>, *://*/*), debugger, nativeMessaging, proxy, management, cookies, webRequest, history and friends each carry documented weights. Every score comes with human-readable flags so you can see why something is critical, not just that it is. It handles both Manifest V2 and V3, and flags extensions abandoned for over a year — the quiet way risky code stays installed forever.

Three input modes 

{
  "searchQueries": ["password manager"],
  "categories": ["extensions/productivity/tools"],
  "maxExtensions": 200,
  "minUsers": 10000,
  "onlyRiskLevels": ["high", "critical"]
}
Enter fullscreen mode Exit fullscreen mode

Paste explicit extension URLs/IDs, run search queries, or enumerate whole categories — mixed in one run. Filters (minUsers, minRating, onlyRiskLevels, requireBroadHostAccess) run before charging: filtered-out extensions are free. The example above returns exactly the shortlist a security reviewer wants — popular extensions with dangerous permission sets.

It's not only for security teams. Extension developers use the same rows to track competitor ratings, user growth and update cadence; acquirers screen for abandoned extensions with big install bases.

Put it on a schedule

The data rots fast — versions ship weekly, permissions change silently on update, new extensions appear daily. The useful setup is not one run, it's a standing audit:

  1. Run once with your allowlist (or a category) as input, sanity-check the output.
  2. On the actor page: ⋯ menu → Schedule Actor, cron 0 7 * * 1 (weekly Monday morning fits most review cadences).
  3. Add a Google Sheets or Slack integration on Run succeeded, filtered to riskLevel in high/critical.

From then on, a permission escalation in an extension your org uses shows up in Slack Monday morning instead of in an incident report.

MCP / AI-agent angle

The actor is exposed via Apify's MCP server, so an AI agent can call it as a tool: "audit these 30 extensions and summarize which ones can read cookies on all sites" becomes one tool call returning structured JSON the agent can reason over. Agent-driven security reviews are exactly the kind of repetitive, structured task this was built for.

I build pay-per-event scrapers for boards people refresh manually — the full portfolio is here. If you try the extension scraper and something's missing, open an issue on the actor; field requests routinely ship within days.

Top comments (0)