Company
About
We built this because teams were either ignoring browser extensions entirely, or using permission-based scanners that told them nothing useful. Both options left them exposed.
The problem we saw
Browser extensions have access to everything: your cookies, your passwords, your tabs, your clipboard, your DOM. A malicious extension is the perfect spy - it sits inside your browser, it persists across reboots, and it exfiltrates data through HTTPS calls that look identical to normal user traffic.
The teams that were paying attention had two options. Most ignored extensions entirely - they were too focused on endpoint agents, network perimeters, and phishing simulations to look at what was running inside the browser. The rest were using permission-based scanners: tools that count how many dangerous permissions an extension declares and call that a risk score. That approach is almost useless. An extension can have minimal permissions and still exfiltrate every credential your team types. An extension can have broad permissions and be completely benign.
We built Am I Being Pwned? to fix that. We analyse the code, not the claims. We monitor what extensions actually do, not what they say they do. And we do it continuously - because an extension that was clean last month might not be clean today.
What we believe
We read the code, check capabilities, and observe behaviour
Static analysis tells you what an extension can do. Real-time capability checks tell you what it is doing. Behavioural observation tells you what it actually sends. We run all three - because any one of them alone misses things the others catch.
Major findings are reviewed by a human before you see them
Not every finding gets manual review - low-severity signals are surfaced automatically. But anything that could materially affect your security posture is checked by a researcher before it reaches your dashboard. We would rather take the time than flood you with noise.
Every finding links to the evidence
Each extension report shows exactly what we found: the specific code, the network calls, the capability being abused. You can read the breakdown yourself, share it with your team, or push back on a finding - because the evidence is right there.
Want to know more?
Email us or book a demo.