Risk Scoring
Every extension gets a 0-100 score based on observed runtime behavior, rather than permission counting or signature matching. Declared permissions add a small, capped amount within the band the evidence sets.
An LLM agent reads the deobfuscated extension source and produces specific, falsifiable claims about what the extension does - not a generic risk category, but a concrete hypothesis: this code path exfiltrates form data, this endpoint receives credentials, this payload is assembled at runtime.
A second LLM agent runs the extension in a live instrumented sandbox with those claims in hand. It drives the extension specifically to test each hypothesis - visiting pages, triggering interactions, watching network traffic. It is trying to prove the static agent right, not just passively observing.
All evidence from the sandbox run is collected alongside the LLM-generated reasoning from both agents - network captures, DOM observations, decoded payloads, and the chain of inference that led to each claim.
Claims are checked against the collected evidence. Verification is mixed: LLM and human. High-severity findings get a human researcher before they reach your dashboard. Low-confidence findings are flagged separately so you can judge them yourself.
Case: Stylish - 2M users
What the profile showed
What the pipeline found
Every URL transmitted through five layers of obfuscation to a data broker on every page load. No user action required.
AI chat content scraped and exfiltrated from ChatGPT, Claude, Character AI, and others.
None of the signals above told you what the extension was doing. The badges are not a security control.
“They build a payload, then put it through URL encoding, double base64, JSON stringify and base64 again, a columnar transposition cipher, AES-256-CBC with a symmetric key hardcoded in the extension source, then base64 one final time.”
Stylish Is Back, Back Again
2M users. Featured and Verified badge. Exfiltrating every URL you visit.
“Any site with the same Country Code eTLD could exfiltrate usernames, passwords, URLs and TOTP codes from any other login on the same eTLD. No user interaction. The manifest was totally fine.”
MultiPassword - CVSS 8.3
1M+ users. Found and disclosed by our pipeline.
“Their median risk score for CRITICAL extensions (46) is actually lower than for CLEAN ones (49). The scores showed no meaningful correlation with actual risk across our sample of 2,534 extensions.”
Spin AI vs Am I Being Pwned
What happens when you score by permissions alone.
Choose the severity at which extensions are blocked automatically: off, critical, or high and above. Everything below that is yours to review, and any extension can be added to the blocklist by hand.
See risk scores for your current extensions.
Free for up to 20 devices. Results within the hour.
