Browser extension
Invite link or Google Admin force-install. Every extension your team runs, continuously monitored.
Latest8 out of 10 Banks HATE This One Weird 3SKey RCE
Find out what isspying on you
Search for problematic browser extensions across your fleet.
Our findings
Our findings
Read the code, not the manifest
A signature scanner only finds patterns it already knows.
We read what the code actually does, every line.
This led us to:
Deobfuscation
Stylish hid behind 4 layers of base64 + AES-256-CBC + a columnar transposition cipher.
We unwrapped all of it.
Re-analysed on every update
Cyberhaven's attackers didn't change permissions, they changed code. We rescan every release, so a trusted extension can't quietly pivot into a stealer.
Novel-attack detection
LLM pipeline catches what no signature has seen: encoded payloads assembled at runtime, weird egress, page leaks.
Instrumented sandbox
An agent drives the extension like a real user, with aged accounts to trigger gated behaviour.
Network egress capture
Every outbound request, traced live
Layered defence. Every finding survives cross-examination before it ever reaches you.
Recently flagged by us
Recent findings.
Threat Intelligence Feed
Plug our intel into your SOC.
Every confirmed finding, malware in silent updates and vulnerabilities in trusted extensions, published as machine-readable threat intel your stack can ingest.
Explore the feedSTIX 2.1 native
Indicators, malware, and relationship objects straight from the spec. No proprietary schema to map.
Mapped to MITRE ATT&CK
Findings carry ATT&CK technique and CWE IDs where mapped, so they drop straight into your existing detections.
// One object from the collection
{
"type": "malware",
"spec_version": "2.1",
"is_family": false,
"name": "Credential exfiltration via hooked fetch",
"x_cws_extension_id": "fjnbnpbm…",
"x_cws_version": "3.1.2",
"x_cws_severity": "critical"
}
Works with
every popular browser
Chrome
Firefox
Safari
Edge
Opera
Brave
Arc
Vivaldi
The pipeline
From every store to a claim you can audit.
How it works
Chrome Web Store
315K extensions
Edge Add-ons
30K extensions
Safari Extensions
12K extensions
01
Static Analysis
Agents read the bundle before it ever runs. Manifest, code and supply chain.
manifest.json · host_permissions · code-bundle · npm-tree · signing-cert
02
Dynamic Analysis
Detonated in a sandboxed browser. Every call, request and write is traced.
network.trace · dom.access · storage.io · eval.calls · exfil.detect
03
Agentic Verification
Multiple agents cross-check findings and reconcile them into a single claim with cited evidence.
cross-ref · dedupe · evidence-link · severity-score
c-47291·Critical
Exfiltrates all URLs in real time
8M Users
c-47263·High
Trusts main world in cryptographic operations
2M Users
c-47218·Low
Scoped to single host, no telemetry
700k Users
Latest research.
Deep-dives on the extensions, vendors, and attack patterns our pipeline surfaced.
8 out of 10 Banks HATE This One Weird 3SKey RCE
SConnect (1M+ users), the extension and native host used to authenticate with 3SKey, SWIFT, eIDs and other hardware signing tokens, had a drive-by RCE: any site or iframe could silently download and run a DLL by exploiting an uninitialised-memory bypass in its hand-rolled RSA-2048 token validation. CVE-2026-18397.
Read post
Poper Blocker: The Adblocker That Spies on You
Read post
Fortinet Privileged Access Agent: Any Site Could Control Your Proxy and Watch Your Tab
Read post
Solar Winds Part 2 Avoided: N-Able Passportal Vault Leak
Read post
8 out of 10 Banks in Belgium HATE This One Weird eID RCE
Read post
Who uses it
Nang
CTO, Streamable
At Streamable, we can't afford security incidents and Am I Being Pwned found problematic extensions we had installed.
Centre for Cybersecurity Belgium
Wall of Fame 2026Recognised for the responsible disclosure of critical vulnerabilities affecting users in Belgium and across the EU.
@phia
Phoebe Gates & Sophia Kianni
Am I Being Pwned made Phia more secure.
Integrations
Plug into your fleet.
Three ways to wire up Am I Being Pwned. Use one or all of them.
REST API
Submit extension IDs, get back risk assessments.
MDM integration
Google Admin Console natively. Intune, Jamf, Kandji or GPO deploy the extension with our policy file.
Pricing
Free for up to 20 devices
Priced by device, with dashboard seats for your security team on every plan.
20 devices
100 devices
1,000 devices
Business
1,000 devices, with room for 5,000.
$239/month
$2,868 billed yearly. +$20 per 100 more devices
5,000+ devices
Every account starts on Free. Business and Enterprise can be tried free for 14 days from your dashboard. Invoice billing on every paid plan. Prices in USD.