MalExt Sentry - Malicious Browser Extension Scanner

Checks extensions against a known-malicious database and their store listing, explains risky permissions, and warns before install.

MalExt Sentry - Malicious Browser Extension Scanner Find and remove malicious browser extensions. MalExt Sentry checks your installed extensions against a public malware database that is updated every day. It confirms each extension really came from the store it says it did. It explains risky permissions in simple words. And it warns you on the Chrome Web Store and Edge Add-ons before you add a known bad extension. NEW IN v2.2.0 - Store check: confirms with Google or Microsoft that an extension claiming a store install is really listed there. - Takedown alerts: you are warned if the store removes an extension you trusted. - Install source for every extension, with unusual sources highlighted. - Flagged version check: on a flagged extension's store page, see whether the store still serves the bad version or a newer one. - After you remove one: see what the extension could access and which accounts to secure first. - Side panel: keep MalExt Sentry open next to the page you are on. - Report button: opens the malext.io report form with the extension's ID already filled in. v2.1.0 - Warnings on Chrome Web Store and Edge Add-ons pages for listed extensions. - Every flag links to its source. - New interface: cleaner, faster and easier to read. HOW IT WORKS 1. Known malware check Every installed extension is checked against a list of extensions flagged or removed from the Chrome Web Store or Edge Add-ons for malware, adware, spyware or data theft. The list is public and hosted on GitHub. 2. Store check If an extension says it was installed from a store, MalExt Sentry asks that store to confirm it. Malware installed by another program often pretends to be a store install. Sideloaded extensions and extensions the store has removed are flagged. Stores often remove malware before any database lists it. Extensions installed by your organization's policy are labeled so you can tell them apart. 3. Warning before you add an extension Open an extension's page on the Chrome Web Store or Edge Add-ons. If it is in the database, you get a toolbar alert and the reason it was flagged, before you add it. Every flag links to its source, so you can check it yourself. 4. Permission check Risky permissions are flagged and explained: - Script injection: can run code on any page you visit - Cookie access: can read your login sessions - Clipboard reading: can read what you copy without asking - Full page control, traffic interception, system access and more 5. Permission change alerts You are warned if an update gives an extension new risky permissions. FEATURES - Background scan every 30 minutes - Alert as soon as a new or re-enabled extension matches a known threat - Optional auto-disable: flagged extensions are turned off right away - One-click uninstall for flagged extensions - Trust list: mute alerts for extensions you know. They are flagged again if their permissions change or the store removes them - Copy a scan report (CSV) to your clipboard - Risk levels (Critical, High, Medium, Low) based on which permissions an extension combines - Open it as a popup, a separate window or a side panel - Works in Google Chrome and Microsoft Edge PRIVACY Everything runs on your device. No account, no telemetry, no analytics, no tracking. Your extension list is never sent to malext.io or to the developer. MalExt Sentry makes three kinds of network request: - Database download: the public database is downloaded from GitHub. Nothing is sent. - Store checks: extension IDs are sent to Google's update service (update.googleapis.com, the same one Chrome uses to update your extensions) and, in Edge, to Microsoft Edge Add-ons. This covers installed extensions that say they came from a store, and any flagged extension whose store page you open. - Reporting: malext.io opens only when you click Report, and only with that one extension's ID. PERMISSIONS - management: read your list of installed extensions so they can be scanned. Nothing is uninstalled without your confirmation. Nothing is turned off unless you enable auto-disable. - storage: save your settings, trust list and the downloaded database on your device. - alarms: run the 30-minute background scan. - notifications: alert you when a threat is found. - sidePanel: let you open MalExt Sentry in the side panel. - Store sites (chromewebstore.google.com, chrome.google.com/webstore, microsoftedge.microsoft.com): read the extension ID from the page address so you can be warned before adding an extension, and check listings on Edge Add-ons. No page content or other browsing data is read. - update.googleapis.com: check whether an extension is listed on the Chrome Web Store. - raw.githubusercontent.com: download the threat database. Open source: https://github.com/toborrm9/malicious_extension_sentry Live database: https://malext.io