OpenSkillIndex← back to search

Hacktricks-skills browser-extension-permission-audit

Audit browser extension permissions and host_permissions for security vulnerabilities. Use this skill whenever analyzing Chrome/Firefox extensions, reviewing manifest.json files, investigating extension security, or pentesting browser extensions. Trigger on mentions of extension permissions, host_permissions, manifest analysis, extension security testing, or when examining potentially malicious browser extensions.

install
source · Clone the upstream repo
git clone https://github.com/abelrguezr/hacktricks-skills
manifest: skills/pentesting-web/browser-extension-pentesting-methodology/browext-permissions-and-host_permissions/SKILL.MD
source content

Browser Extension Permission Audit

A skill for analyzing browser extension permissions and identifying security vulnerabilities in Chrome/Firefox extensions.

When to Use This Skill

Use this skill when:

  • Analyzing a browser extension's 
    manifest.json
    file
  • Investigating potentially malicious extensions
  • Pentesting browser extensions for security vulnerabilities
  • Reviewing extension permissions for compliance
  • Auditing extensions for excessive privilege requests
  • Investigating extension-based attacks or data exfiltration

Quick Start

# Analyze a manifest.json file
python scripts/analyze_manifest.py path/to/manifest.json

# Check for dangerous permission combinations
python scripts/check_risky_permissions.py path/to/manifest.json

Understanding Extension Permissions

permissions
vs 
host_permissions

permissions
- Controls access to privileged browser APIs:

  • storage
    - Persistent key-value storage (can't be cleared without uninstalling)
  • cookies
    - Access to all browser cookies (credential theft risk)
  • tabs
    - Tab management and monitoring
  • history
    - Full browsing history access
  • bookmarks
    - Read all bookmarks
  • clipboard
    - Monitor clipboard for passwords
  • geolocation
    - Track user location
  • webRequest
    - Intercept and modify network requests
  • scripting
    - Execute arbitrary code in pages
  • declarativeNetRequest
    - Block/redirect traffic

host_permissions
- Controls which origins APIs can access:

  • "*://*/*"
    or 
    "<all_urls>"
    - Access to ALL websites (extremely dangerous)
  • "http://*/*", "https://*/*"
    - Same as above
  • Specific patterns like 
    "https://example.com/*"
    - Limited scope

Critical Permission Combinations

CombinationRiskImpact
cookies
+ broad 
host_permissions
🔴 CriticalCan steal auth cookies from any site
scripting
+ 
<all_urls>
🔴 CriticalCan inject code into any page
webRequest
+ 
<all_urls>
🔴 CriticalCan intercept/modify all traffic
storage
+ 
tabs
+ 
host_permissions
🟠 HighWallet drain pattern
history
+ 
bookmarks
🟡 MediumUser profiling
geolocation
+ 
clipboard
🟡 MediumPrivacy invasion

Audit Workflow

Step 1: Extract and Parse Manifest

# If you have the extension package
unzip extension.crx -d extension/
cat extension/manifest.json | python scripts/analyze_manifest.py -

Step 2: Identify Risky Permissions

Run the permission checker:

python scripts/check_risky_permissions.py manifest.json

This will flag:

  • Overly broad 
    host_permissions
  • Dangerous API combinations
  • MV3-specific risks (
    declarativeNetRequestWithHostAccess
    )
  • Implicit privilege abuse patterns

Step 3: Analyze Runtime Behavior

Check for these abuse patterns:

Cookie Theft:

// Look for this pattern in background scripts
chrome.cookies.getAll({}, function(cookies) {
  // Exfiltration attempt
});

Dynamic Script Injection:

// Dangerous: arbitrary code execution
chrome.tabs.executeScript(tabId, {code: maliciousCode});
chrome.scripting.executeScript({func: maliciousFunc});

Traffic Hijacking:

// MV3 rule injection
chrome.declarativeNetRequest.updateDynamicRules({
  addRules: [{
    action: { type: "redirect", redirect: { url: "https://attacker.tld" } }
  }]
});

Step 4: Check for Supply Chain Risks

  • Verify extension signature and publisher
  • Check update history for sudden permission changes
  • Look for 
    declarativeNetRequestWithHostAccess
    (weaker install prompt)
  • Review Web Store API key usage patterns

Common Abuse Patterns

1. Supply-Chain Trojanized Updates

  • Stolen developer accounts push MV3 updates
  • Add 
    <all_urls>
    + 
    declarativeNetRequest
    /
    scripting
  • Inject remote JS to siphon headers/DOM content

2. Wallet Drains

  • Host access + 
    storage
    + 
    tabs
  • Backdoored wallet extensions exfiltrate seeds
  • Stolen Web Store API keys ship malicious builds

3. Cookie Theft

  • cookies
    + broad host access
  • Reads auth cookies despite 
    HttpOnly
  • Treat as credential-stealing capable

4. Implicit Privilege Abuse

  • tabs.create()
    - Bypass popup blockers, create unlimited tabs
  • tabs.update()
    - Modify existing tabs, load ads
  • data:
    URIs in Chrome - Phishing attacks
  • Webcam/microphone - One-time prompt, then always-on access

Prevention Recommendations

For Users

  1. Review permissions before installing extensions
  2. Use 
    activeTab
    permission when possible (user-initiated only)
  3. Check extension permissions regularly in browser settings
  4. Remove unused extensions immediately
  5. Be wary of extensions requesting 
    <all_urls>

For Developers

  1. Request minimum necessary permissions
  2. Use 
    activeTab
    for user-initiated actions
  3. Avoid 
    host_permissions
    when possible
  4. Implement runtime permission requests for optional features
  5. Follow Google's policy: no excessive privileges

For Security Teams

  1. Monitor extension update patterns
  2. Check for sudden permission escalations
  3. Audit 
    declarativeNetRequest
    rules
  4. Review 
    chrome://extensions/?errors
    for hidden issues
  5. Test with 
    chrome://extensions/?id=<id>
    for developer mode

Reference Commands

# Chrome extension inspection
chrome://extensions/?id=<extension-id>
chrome://extensions/?errors

# Firefox extension inspection
about:debugging#/runtime/this-firefox

# View extension permissions
chrome://extensions/ (click extension → Details)

Scripts

analyze_manifest.py

Analyzes manifest.json and reports permission risks.

check_risky_permissions.py

Checks for dangerous permission combinations and abuse patterns.

References