How to download and audit Chrome extensions from Chrome Web Store

gistfile0.txt

# How to Download & Audit Chrome Extensions

## Method 1: Direct CRX Download via API

```bash
# Replace <EXTENSION_ID> with the target extension ID
EXT_ID="<EXTENSION_ID>"
curl -L -o extension.crx "https://clients2.google.com/service/update2/crx?response=redirect&prodversion=120.0.0.0&acceptformat=crx2,crx3&x=id%3D${EXT_ID}%26uc"

# Extract (CRX v3 is a zip with a header)
unzip extension.crx -d extracted/
```

The extension ID is the string in the Chrome Web Store URL:
`https://chromewebstore.google.com/detail/name/<EXTENSION_ID>`

## Method 2: Using Online Tools

- [crxdown.com](https://crxdown.com/) — paste the store URL, get a ZIP
- [standaloneinstaller.com/crx-downloader](https://standaloneinstaller.com/online-tools/crx-downloader) — same approach

## Method 3: Using a Downloader Extension

1. Install [CRX Downloader](https://chromewebstore.google.com/detail/crx-downloader/ldckkdbkiedbecopncppoajknabpnifk) or [CRX Extractor](https://chromewebstore.google.com/detail/crx-extractordownloader/ajkhmmldknmfjnmeedkbkkojgobmljda)
2. Navigate to the target extension's Chrome Web Store page
3. Click the download button

## Audit Checklist

After extracting, review these files:

| File | What to check |
|------|--------------|
| `manifest.json` | Permissions, host_permissions, content_scripts — are they minimal? |
| `background.js` / `service_worker.js` | Network requests (any 3rd-party servers?), `chrome.cookies`, `chrome.scripting` usage |
| `content_scripts` | DOM manipulation, data exfiltration, credential harvesting |
| `*.js` (all) | `eval()`, `innerHTML` without escaping, `fetch()` to unknown domains |
| `*.html` | Inline scripts (blocked by MV3 CSP, but check for loopholes) |
| `_metadata/` | Store listing metadata, compare version with what's published |

### Quick Red Flags

- `host_permissions` with broad domains (`*://*/*`, unrelated 3rd-party domains)
- `fetch()` / `XMLHttpRequest` to servers not related to extension functionality
- `chrome.cookies.getAll()` without clear justification
- Base64-encoded strings or obfuscated code
- Excessive console.log that leaks sensitive data (cookies, tokens)