Code Analysis
We read the code and form hypotheses about it
We deobfuscate the source, read it, and write down specific claims about what the extension is doing. Each claim is then tested in a live sandbox to confirm or reject it.
Deobfuscation
Extension source is unpacked and decoded before analysis begins. We've reversed the obfuscation schemes common in the wild - base64 stacking, LZ-String compression, columnar transposition ciphers, AES-CBC with hardcoded keys, and beyond. Where code resists deobfuscation, the extension is flagged for human review rather than scored on incomplete evidence. You cannot analyse code you cannot read.
Static claim formation
An LLM agent reads the deobfuscated source and writes down concrete, testable claims: this function exfiltrates form inputs to this domain, this payload is assembled at runtime, this message listener accepts untrusted origins. These claims drive the dynamic analysis stage.
Feeds dynamic analysis
The claims from static analysis are handed to a second agent that runs the extension in a live instrumented sandbox and tries to prove them. Static analysis tells us where to look. Dynamic analysis tells us what actually happens when the code runs.
What static analysis surfaces
- Exfiltration payloads encoded through multiple obfuscation layers to evade review
- C2 registration - extensions phoning home for instructions before activating
- Cross-origin postMessage vulnerabilities leaking credentials to untrusted pages
- Credential scope bugs letting one site read another site's stored passwords
- Script injection targeting login pages and internal tools
- Supply chain diffs - new payloads in an otherwise trusted extension update
- Architecture flaws that undermine an extension's own security model
What signature scanners see
- tabs permission
- storage permission
- scripting permission
- No known-bad signatures matched
What our static agent claims
- Function at line 847 encodes current URL with AES-256-CBC and posts to a third-party analytics endpoint
- Payload construction assembles URL + user ID through 5 transformation stages before transmission
- No user-visible indicator of data transmission found in any content script or popup
Example from Stylish - 2M users, Featured and Verified badge. The claims above were confirmed by dynamic analysis. Read the full writeup.
See a real finding in under 60 seconds.
Enrollment takes minutes, no credit card.