Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am scanning browser extensions of Chrome and Firefox for vulnerabilities. Is there any tool which would help me do this?

share|improve this question

There is one for Chrome, released mid-last year, called XSS ChEF. Based on some earlier work finding vulnerabilities in Chrome extensions. Unfortunately it doesn't seem to be about finding new vulnerabilities but rather an easier way of exploiting/demonstrating them once you have found one.

I haven't used it myself but based on the way it works (it's just a web server), I imagine it's possible to use it to exploit Firefox extensions too or at least to extend it to be able to access Firefox internal state once you have found a vulnerable extension.

BeEF might be a good place to start looking too.

share|improve this answer

One similar tool is Qualys BrowserCheck but it announces that checks for plugin vulnerabilities and not for extension vulnerabilities. I have tried it and just detects updates for plugins in my case. Remember that, as @Ladadadada has commented, browser plugins and extensions are different elements.

Qualys BrowserCheck will perform a security analysis of your browser and its plugins to identify any security issues.

share|improve this answer
Plugins and extensions are different things (at least in Firefox). For instance, Flash and Java are plugins, Adblock and NoScript are extensions. I suspect Qualys are only talking about the former. – Ladadadada Apr 6 '13 at 8:21

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.