IMPORTANT: This is in noway a full list of the things you should look for, use this answer as an example, a first step in your path and research on your own. I've had a similar task long time ago. I had to security-wise review the code of a Firefox addon, I'm sure you'll easily find Chrome/other browsers' equivalents. Also have in mind the Extensions in Chrome run in a Sandbox.
1. Anything that interacts with local files:
Whenever the FileUtils.File
object is created and any of its methods is called
Check if the local file access is a documented behavior. What are files being accessed? Why? Are they released successfully?
Check if any local files are being modified. Is that a documented behavior? What are the modified files? Why?
2. Anything that interacts with Windows Registry:
Whenever an instance of nsIWindowsRegKey
is created or any of its methods is called
3. Anything that interacts with the cookies
Whenever nsICookieService
is used
4.Any commands executed in the user's shell
Whenever nsIProcess
is created and any of its methods called (closely watch .run()
and .launch()
)
5. Any window/tab being accessed
Whenever window
is accessed and/or any getElement*
method is called (closely watch createElement
calls that inject <script>
elements.