Browser extension penetration testing
An extension holds keys, sees every site the user visits, and is the last thing between them and a signature. Guardian reviews it from both directions: what a hostile website can pull out of it, and what a compromised update could do to the users who already trust it.
Offchain · Browser Extension Pentest
Software you ship that runs inside every page a user opens.
- Permissions and manifest What the extension is allowed to reach, whether it needs all of it, and how far a malicious version could go using only the access users already granted.
- Content scripts What gets injected into every page, what a hostile site can reach through it, and how the extension stays separated from the page's own code.
- Internal messaging The routes between content script, background worker, and popup, and whether an untrusted page can send a message that lands on a privileged handler.
- Key and session storage Where keys, seeds, and tokens live, how they are encrypted at rest, and what stays readable while the wallet is unlocked.
- Signing flows What the user is actually shown before approving, and whether the payload that gets signed matches what was on screen.
- Supply chain Dependencies bundled into the shipped package, integrity of the build, and who is able to publish an update to the store.
A large part of an extension review is shared across every extension, covering manifest, permissions, storage, and messaging, which makes the engagement predictable to plan. Source code is effectively required: a store download alone cannot confirm that every code path was reviewed.
One phished developer account was enough to publish a malicious update. It reached roughly 400,000 users before anyone noticed. Cyberhaven · 400k users (read the incident write-up)
Send the store listing and the repository to get scoped.
Audits & Pentests
Other engagements
Start now