See exactly what every browser extension on your machine can actually do — and which ones to worry about. CRXRAY scans the extensions installed in your real browser profiles (Chrome, Edge, Brave, Chromium, Vivaldi, Opera and Firefox), explains their permissions in plain English, and flags the over-permissioned, sideloaded, unsigned and recently-changed ones.
An open-source NEATLABS tool · MIT · one dependency · 100% local, offline, read-only
Browser extensions are one of the most over-privileged things on your computer. A single extension can be granted the ability to read and change every website you visit, read your cookies and session tokens, watch your network traffic, or talk to native programs — and most people have no idea which of theirs can.
The tool everyone used for this, CRXcavator (Duo/Cisco), shut down in 2023. What's left is either enterprise-priced or a cloud API — and crucially, every one of those tools works by looking up a published extension by its store ID. That means they structurally cannot see the extensions that matter most: the sideloaded ones that were never in a store, and the hijacked ones whose installed code no longer matches the listing.
CRXRAY takes the opposite approach. It reads the extensions actually installed on your machine, offline, so it can see what store-based scanners can't. No account, no upload, nothing leaves the box — fine for a personal laptop, a managed endpoint, or an air-gapped workstation.
- Finds every installed extension across Chromium-family browsers (Chrome, Edge, Brave, Chromium, Vivaldi, Opera) and Firefox, across all profiles, on Windows, macOS and Linux.
- Explains permissions in plain English — "Read and change your data on every website," "Route your traffic through a proxy it controls," "Read your cookies, which can include login tokens" — each rated Critical → Info.
- Flags what matters, with remediation for each finding:
- Broad host access (can read/change all sites)
- Sideloaded — installed outside the official store
- Unsigned add-ons (Firefox)
- High-risk permissions (debugger, proxy, nativeMessaging, cookies, webRequest, history…)
- Can manage your other extensions
- Content scripts injected into every page at load time
- Self-updates from a non-store URL
- Manifest V2 (deprecated, more permissive)
- Recently installed/updated (hijacks ride in on silent updates)
- Grades your browser hygiene A–F and scores each extension 0–100.
- Exports a clean HTML report for an audit, a ticket, or a compliance file.
- Explains itself — a built-in Help guide (F1) covers what the grade, severities, flags and every check mean, plus a simple triage workflow.
Click 🧪 Load demo for a realistic sample audit — a clean theme, a legitimate-but-powerful ad blocker, an over-permissioned coupon extension, a sideloaded developer tool with debugger access, and an unsigned Firefox VPN that routes your traffic. It shows you exactly what CRXRAY surfaces before you scan your own browsers.
CRXRAY needs Python 3.10+ and one dependency.
git clone https://github.com/neatlabs-ai/crxray.git
cd crxray
pip install -r requirements.txt
python main.pyOn Linux you may also need Tk: sudo apt install python3-tk.
Run it from the project folder.
main.pyneeds thegui/andcrxray/folders next to it. If you seeModuleNotFoundError: No module named 'gui',cdinto the folder that contains them and run there.
crxray/
models.py # severity, findings, Extension, ScanResult, grading
permissions.py # permission → severity + plain-English catalog
discover.py # cross-OS profile discovery (Chromium family + Firefox)
chromium.py # parse manifest.json + _locales + Preferences (install/state/sideload)
firefox.py # parse extensions.json (signing state, permissions)
analyze.py # risk checks → findings + remediation
scanner.py # discover → parse → analyze → ScanResult; save/load
report.py # standalone HTML report
demo.py # realistic sample profiles (also the test fixture)
gui/ # CustomTkinter app (scan / dashboard / list / detail / report)
main.py # launch
It reads real on-disk formats: each Chromium extension's manifest.json (resolving localized __MSG__ names) merged with the profile's Preferences for install time, enabled state, and whether it came from the web store; and Firefox's extensions.json for signing state and permissions. Read-only — CRXRAY never modifies a profile. Pure standard library; the only third-party dependency is the GUI toolkit.
CRXRAY tells you what an extension is allowed to do and flags risky signals — it doesn't execute or dynamically analyze extension code, and a high risk score isn't proof of malice (an ad blocker legitimately needs broad access). It's a fast, local triage that surfaces what to look at, including the sideloaded and unsigned extensions that store-based tools miss.
Built by Randy Bator · NEATLABS Local · offline · read-only · MIT License