| name | browser-extension-reverse |
| description | Reverse engineer browser extensions: unpack CRX/XPIs or load unpacked directories, audit manifest permissions for overreach, trace content and background script data flows, extract API endpoints and storage keys, and detect malicious or data-exfiltrating behavior. Use when analyzing extension security posture, suspicious extensions, or extension-based attack chains. |
| domain | cybersecurity |
| subdomain | web-application-security |
| tags | ["browser-extension","reverse-engineering","malware-analysis","manifest","chrome","firefox","supply-chain"] |
| version | 1.0 |
| author | oyi77 |
| license | Apache-2.0 |
| nist_csf | ["DE.AE-02","RS.AN-03","ID.RA-01","DE.CM-01"] |
Browser Extension Reverse Engineering
Overview
Browser extensions (Chrome/Edge MV2/MV3, Firefox) run with privileges a web
page does not have: cross-origin requests, webRequest interception, storage
access, and native messaging. That elevated trust makes them a high-value
target for both attackers (malicious extensions, supply-chain poisoning of
popular extensions) and defenders (credential or traffic logic recovery).
This skill covers the full extension analysis workflow: package acquisition,
manifest permission audit, content/background script tracing, dynamic
loading in developer mode, and the data-flow reconstruction that ties it
together. Complex obfuscated inner logic routes into the general JavaScript
workflow (js-reverse); poisoning investigations route into supply-chain
and malware analysis.
Source: cherry-picked and translated from zhaoxuya520/reverse-skill
(skills/browser-extension-reverse, MIT license); reference notes
(extension-analysis.md) inlined.
When to Use
Trigger phrases:
- "analyze this browser extension"
- "is this extension malicious"
- "what does this extension do with my data"
- "unpack a crx and trace its logic"
- "extension supply-chain investigation"
- "recover an extension's signing or proxy logic"
Use this skill when:
- The target is a browser extension (crx/xpi/unpacked directory), not a
plain web page — plain page JS routes to
js-reverse.
- You must assess an extension's permission surface, extract its endpoints,
or determine whether it exfiltrates data.
Prerequisites
- Chrome/Edge (MV2/MV3) or Firefox.
- An archive tool (unzip/7z) or
jq for manifest parsing.
- Chrome DevTools for worker debugging; YARA for malicious-extension rules.
Workflow
Phase 1: Package
- Acquire the package: unpack the CRX/XPI archive, or copy the extension
directory out of the browser profile.
- Read
manifest.json: permissions, host_permissions,
background/service_worker, content_scripts.
- Assess overreach before reading a single script (risk signals table
below).
Phase 2: Logic
- Locate the
service_worker / background entry point and the
injection points and their worlds (isolated vs main).
