CRXcavator is dead. The attacks moved past the manifest.
It started flaking out in late 2023 and was gone by 2024, with no shutdown notice we've ever been able to find. If your wiki, your procurement doc or your onboarding checklist still points at crxcavator.io, it's pointing at nothing.
We run the same static checks it ran, then keep going: we unpack the exact build your fleet is running and install it in an instrumented browser to see where it sends things.
Free to scan an extension, no account needed. The extension we deploy to a fleet collects extension IDs, versions and permissions only, no browsing data or page content.
Free lookup
Check one now.
Paste an extension ID or name. No account, no card, same as you did with crxcavator.io.
What happened
What CRXcavator actually was
Duo Labs, February 2019 to 2024.
It launched out of Duo Labs in February 2019: a pile of embarrassingly parallel Lambda functions that walked the whole Chrome Web Store, pulled each CRX, unpacked it and ran a battery of static checks. Free, no account, beta its entire life. The backend was never open sourced, which is why nothing cleanly replaced it. When the AWS account was switched off, the code went with it.
The three components everybody actually looked at were permissions, CSP and RetireJS, added together. Permissions had per-API weights, CSP graded each directive from tightly restricted down to not defined at all, and RetireJS flagged known-vulnerable libraries. The team behind it knew exactly what was wrong with this: the score measured risk surface, not malicious intent, so a password manager with legitimately broad permissions outranked a tightly scoped credential stealer.
It caught real things
In February 2020 the researcher Jamila Kaya used CRXcavator to pull on a cluster of suspicious extensions. Working with Jacob Rickerd and Google's threat analysis team, that became 500+ malicious extensions affecting around 1.7 million users. Google pulled the lot.
The Gatherer is what made it stick
The companion extension fed fleet inventory back into the dashboard, and the public API spawned a small ecosystem of open-source clients and Splunk SOAR connectors before the lights went out. That's the bit people actually miss.
The gap
Four things a permission score was never going to catch.
A permission score reads the manifest. None of these four touch it.
Supply chain compromise
Cyberhaven, December 2024: 35+ extensions, around 2.6 million users. The malicious release declared exactly the same permissions as the legitimate one, because the attackers got publish rights through a malicious OAuth app rather than by changing the manifest. There's no permission change to diff, so the scanner returns the same number it did last week.
Obfuscated exfiltration
Stylish came back with a verified publisher badge, a featured listing, and full browsing-history exfiltration under four layers of base64, a columnar transposition cipher and AES-256-CBC. RetireJS doesn't see that. Nothing static really does.
Manifest looks fine, code is rotten
The MultiPassword CVSS 8.3 I disclosed had a totally clean manifest. A content script trusted a postMessage from the page, so any site sharing a country-code eTLD could pull plaintext passwords and TOTP codes out of the vault. No permission check catches that, because no permission was wrong.
Same permissions, different product
Password managers need scripting. Stylish does need every hostname. WhatRuns does need to read the page. The permissions are honest in all three, and the same set powers a perfectly nice ad blocker or a credential stealer, depending on what the JavaScript decides to do that morning.
The replacement
Don’t trust the manifest, read the code.
We take the exact bundle running on your fleet apart, then install it in an instrumented browser and watch what it actually does.
We analyse the exact version your fleet is running, not whatever the store ships today, and we unpack it before judging anything.
- Packed and obfuscated bundles normalised first
- Declared permissions diffed against the APIs the code actually calls
- Page content and cookies traced through to network sinks
A loader that fetches its payload at runtime looks like nothing on disk. So we install it in an instrumented browser and let an agent drive it the way a person would: webmail, admin console, banking.
- Every DOM read, cookie access and outbound request recorded
- Message passing followed across content scripts, workers and iframes
- Region, delay and domain varied to shake out conditional payloads
Then a human checks it
An LLM pipeline reasons over the deobfuscated source and the runtime traces. The things I most want to catch are the ones no published signature has seen yet: odd egress destinations, content-script-to-page leaks, payloads assembled at runtime. Then a researcher checks anything serious before it lands in a customer dashboard, because LLMs hallucinate and a wrong "this extension is stealing passwords" is much worse than a slow one. That bit costs a fortune and we keep doing it anyway.
- Nothing critical or high ships on model output alone
- Every verdict links to the evidence that produced it
- Disclosed to the vendor first, published after
Proof
Receipts from the last six months
Methodology arguments are cheap, so here's what it's actually caught. A permission-based scanner gave most of these a clean or near-clean score.
MultiPassword
A password manager with 1M+ users leaking usernames, passwords, URLs and TOTP codes to any site on the same eTLD. CVSS 8.3, and a completely clean manifest.
Read the breakdownStylish
2M+ users at peak, verified publisher, featured listing. Every URL you visit sent to a data company under four layers of obfuscation.
Read the breakdown2,534 extensions tested
The median permission score for the ones we rated CRITICAL came out lower than for the ones we rated CLEAN. The score isn't weak, it's uncorrelated.
Read the breakdownUndisclosed findings put us on Belgium's Centre for Cybersecurity Wall of Fame in March 2026. Further disclosures are with vendors now, under coordinated timelines. Read more.
Migration
If you're still linking to crxcavator.io
Six things to swap in. Any score still pasted in your wiki is two years stale.
- 1
- 2
Replace the Gatherer
Google Workspace read-only, our extension by MDM, or SentinelOne.
See the integrations - 3
Import your blocklist
Workspace also pulls your existing Chrome blocklist across. No re-keying.
Google Workspace setup - 4
Decide what happens on a bad verdict
One click force-removes it on every enrolled device at the next fetch.
How enforcement works - 5
Wire it into what you run
REST API, webhooks on change, indicators pushed to your threat intel store.
API docs - 6
Update the wiki
Swap the crxcavator.io links in your runbooks. Those scores are stale.
FAQ
What people ask us about it.
Find out what your fleet is actually running.
Scan a single extension free, or connect your fleet and get the whole inventory with evidence attached. 14-day trial, no card required.
CRXcavator was a Duo Security / Cisco project. Named here for identification only; this page is written by Am I Being Pwned.