Browser extension reverse engineering

When it applies

The target is a browser extension — a .crx/.xpi package or an unpacked extension directory — not ordinary page JavaScript (for that, load reverse-eng-js). Typical jobs: audit an in-scope extension's client-side signing/encryption/proxy logic, hunt for over-privileged permissions in a review, or investigate a malicious or supply-chain-poisoned extension. Target must be confirmed in scope.txt (tradecraft-scope-roe); for malicious samples work in an isolated VM and see defense-malware-triage.

Why it works

An extension is just a zip with a manifest.json that declares its entire trust surface — permissions, host permissions, entry scripts. Reading the manifest first tells you exactly which scripts can touch which origins, and every browser-API capability (webRequest, cookies, nativeMessaging) is reachable by grepping for chrome.* / browser.* calls from those entry points. The dynamic half is free: Chrome runs unpacked extensions natively and DevTools attaches straight to the background service worker.