I am scanning browser extensions of Chrome and Firefox for vulnerabilities. Is there any tool which would help me do this?


There is one for Chrome, released mid-last year, called XSS ChEF. Based on some earlier work finding vulnerabilities in Chrome extensions. Unfortunately it doesn't seem to be about finding new vulnerabilities but rather an easier way of exploiting/demonstrating them once you have found one.

I haven't used it myself but based on the way it works (it's just a web server), I imagine it's possible to use it to exploit Firefox extensions too or at least to extend it to be able to access Firefox internal state once you have found a vulnerable extension.

BeEF might be a good place to start looking too.


One similar tool is Qualys BrowserCheck but it announces that checks for plugin vulnerabilities and not for extension vulnerabilities. I have tried it and just detects updates for plugins in my case. Remember that, as @Ladadadada has commented, browser plugins and extensions are different elements.

Qualys BrowserCheck will perform a security analysis of your browser and its plugins to identify any security issues.


  • 2
    Plugins and extensions are different things (at least in Firefox). For instance, Flash and Java are plugins, Adblock and NoScript are extensions. I suspect Qualys are only talking about the former. – Ladadadada Apr 6 '13 at 8:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.