Chrome Extension Source Viewer - X-Ray

View and inspect Chrome extension source code, CRX files, permissions, network APIs, security risks, and manifest in real-time.

Chrome Extension Source Viewer - X-Ray is a next-generation developer inspection suite and security audit tool built natively for Chrome's Side Panel. View, explore, and analyze extension source code, CRX/ZIP packages, manifest declarations, permissions, and network APIs in real-time without leaving your current tab. Whether you are auditing an extension before installation, reverse-engineering architecture, verifying Manifest V3 compliance, or scanning for exposed credentials, Extension X-Ray delivers instant, sandboxed transparency. ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ ⚡ CORE CAPABILITIES ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 🔍 1. Real-Time Source Code Inspection • Instant Source Exploration: Inspect any extension directly from the Chrome Web Store, by extension ID, or via local drag-and-drop (.crx or .zip). • Full-Featured File Tree: Navigate directories, background scripts, content scripts, and HTML/CSS assets with Monaco-grade syntax highlighting. • Deep Search & Regex: Filter and search across all files in the package instantly. • Offline Export: Download clean, uncompressed ZIP archives for offline code review in VS Code or your favorite IDE. 🛡️ 2. Security Audit & Secret Scanner • Leaked Credential Detection: Scans source code for accidentally committed API keys, tokens, webhooks, and private certificates using entropy analysis. • Attack Surface Mapping: Highlights sensitive API calls, dynamic evaluation (`eval`), and externally reachable listeners. • Cryptographic Integrity: Validates SHA-256 file hashes to verify package authenticity. 📋 3. Permission & Host Access Analyzer • Detailed Permission Breakdown: Categorizes requested permissions into Safe, Elevated, and High-Risk. • Broad Host Pattern Flags: Warns against excessive host permissions (`<all_urls>`, broad wildcards) that could compromise user browsing sessions. • Data Exfiltration Warning: Flags potential tracking vectors and unverified third-party endpoints. ⚡ 4. Manifest V3 Compliance & Network Audit • Modern MV3 Diagnostics: Detects deprecated background page patterns, blocking webRequest APIs, and non-declarative rule usage. • Network & Domain Mapping: Identifies external endpoints, analytics domains, CDNs, and backend endpoints embedded in scripts. • CSP Verification: Audits Content Security Policy headers to detect loose scripting rules. 📐 5. Architecture & Clean Rebuild Blueprint Generator • Decompilation Specs: Generates structured architectural blueprints and component breakdowns. • Developer Modernization: Get prompt-ready prompts to refactor legacy extensions into clean, modern Manifest V3 standards. ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 🔒 PRIVACY & SANDBOXED SECURITY ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ • 100% Client-Side Processing: Code decompression, parsing, and AST audits run strictly inside your client browser sandbox. • Zero Telemetry: No browsing history, inspected source files, or credentials are ever recorded or transmitted. • Safe Inspection: Inspect extensions safely without executing their background scripts or injecting untrusted code into your web pages. ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 🚀 HOW TO USE ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 1. Click the Extension X-Ray icon in your Chrome toolbar or right-click any page and select "Inspect with Extension X-Ray". 2. The Side Panel opens automatically alongside your active tab. 3. Browse the file hierarchy, analyze permissions, audit security scores, or export the ZIP package with one click. ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ ⚠️ DISCLAIMER ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ Chrome Extension Source Viewer - X-Ray is an independent developer and security audit tool created for educational, analytical, and security auditing purposes. This extension is not affiliated with, endorsed by, or sponsored by Google LLC or the Chrome Web Store. All product names, logos, and brands referenced are property of their respective owners.