How do I check the code of a Chrome extension to make sure it's not stealing my info?

Question

I've been reading more and more about just how much access browser extensions can have to your data. This is a little unsettling, so I'm curious if there is a way to Vet these extensions and make sure they're not sending any personal info back to their servers.

Is there a way to check this?

Edit: I know there is a Chrome Extension called: Extension Gallery and Web Store Inspector Link: https://chrome.google.com/webstore/detail/bbamfloeabgknfklmgbpjcgofcokhpia

And it seems that it would give me some good info, but I'm not a code guy so honestly I'm not sure what I'm looking for with this info. Thoughts?

Answer 1

First of all I would pay attention to Permission Warnings.

Performing an analysis of an extension is a game of cat and mouse. You can sniff the network traffic and the attacker can use Stenography. You could unpack the extension and look at the JavaScript code, but the malicious code could be obfuscated or underhanded.

That being said. Chrome runs extensions in a sandbox. These extensions run JavaScript very similarly to JavaScript that run in the context of a website with only a few added permissions. These extensions don't have access to the shell or the file system or even to another extension's data store. They are limited in the number of HTTP requests that they can make to prevent DDoS. Its not a very ripe target.