How to view-source of a Chrome extension

how-to-view-source-of-chrome-extension.md

Option 1: Command-line download extension as zip and extract

extension_id=jifpbeccnghkjeaalbbjmodiffmgedin   # change this ID
curl -L -o "$extension_id.zip" "https://clients2.google.com/service/update2/crx?response=redirect&os=mac&arch=x86-64&nacl_arch=x86-64&prod=chromecrx&prodchannel=stable&prodversion=44.0.2403.130&x=id%3D$extension_id%26uc" 
unzip -d "$extension_id-source" "$extension_id.zip"

Thx to crxviewer for the magic download URL.

Option 2: Use the CRX Viewer website

https://robwu.nl/crxviewer/

Option 3: Use the CRX Viewer extension

The Chrome extension source viewer is open source (github repo) and makes this super easy.

Option 3: View source of locally installed extension

1. Find your Chrome local profile directory. Open chrome://version/ and find the "Profile Path:` field. Open that folder up.
2. Open the Extensions/ subfolder
3. All your extensions are here, with typically readable source.

Mapping between locally installed extension IDs and names

• On about:extensions, turn on Developer Mode and you'll see IDs under each entry
• Inside the Extensions/ folders, the manifest.json has a readable name field

tl;dr

Either set prodversion to the most recent Chrome release or use the following:

extension_id=jifpbeccnghkjeaalbbjmodiffmgedin
https://clients2.google.com/service/update2/crx?response=redirect&prodversion=2147483647&x=id%3D${extension_id}%26uc&acceptformat=crx3

Explanation

It turns out Chrome extensions have an optional manifest key minimum_chrome_version.

Apparently while making the switch from Manifest V2 to Manifest V3 extension developers are increasingly making use of it.

The extension I used as example above had "minimum_chrome_version": "88" added to the manifest in December 2023.

Behind the scenes the Google API appears to verify minimum_chrome_version by checking the value of prodversion.

So in this case a value less than 88 will result in an empty response body.

$ curl -Ls -o /dev/null --write-out '%{http_code}\n' "https://clients2.google.com/service/update2/crx?response=redirect&prodversion=87&x=id%3Djifpbeccnghkjeaalbbjmodiffmgedin%26uc&acceptformat=crx3"
204

but a value >=88 will deliver the extension.

$ curl -Ls -o /dev/null --write-out '%{http_code}\n' "https://clients2.google.com/service/update2/crx?response=redirect&prodversion=88&x=id%3Djifpbeccnghkjeaalbbjmodiffmgedin%26uc&acceptformat=crx3"
200

The largest value that works for prodversion is 2147483647.

$ curl -Ls -o /dev/null --write-out '%{http_code}\n' "https://clients2.google.com/service/update2/crx?response=redirect&prodversion=2147483647&x=id%3Djifpbeccnghkjeaalbbjmodiffmgedin%26uc&acceptformat=crx3"
200

$ curl -Ls -o /dev/null --write-out '%{http_code}\n' "https://clients2.google.com/service/update2/crx?response=redirect&prodversion=2147483648&x=id%3Djifpbeccnghkjeaalbbjmodiffmgedin%26uc&acceptformat=crx3"
204

So apparently Google uses a signed 32-bit integer variable for processing the parameter prodversion resulting in $2^{31}-1 = 2147483647$ as the maximum value.