Reversing Browser Extensions

A browser extension is a small privileged program wedged next to every page the user visits. Its security is almost entirely about a boundary: the content script runs beside untrusted web content but can talk to a background context that holds real permissions — cookies, tabs, the network, sometimes a native process. Reversing an extension is reading that boundary and finding where the privileged side trusts the unprivileged one.

When to Use

• Analyzing a suspicious, over-permissioned, or unknown extension's behaviour
• Auditing an extension's manifest and message-passing for privilege leaks
• Investigating how a content script exposes background/native capabilities to a page
• Recovering what an extension actually does versus what its store listing claims

When NOT to Use