HIGH RISK of store rejection or delisting
This build has a manifest signal that stores commonly reject or delist for. Fix the high-impact items below before you submit.
Store compliance
Why stores care: extension_pages relaxes the default CSP with 'unsafe-eval', which Chrome Web Store rejects for MV3 submissions.
extension_pages: script-src 'self' 'unsafe-eval'
How to fix: Remove 'unsafe-eval' and precompile any dynamic rules at build time.
Why stores care: <all_urls> grants read/write access to every site the user visits and triggers a manual review.
host_permissions: <all_urls>
How to fix: Narrow to the origins you actually need, or move to the optional_host_permissions + activeTab pattern.
Why stores care: <all_urls> grants read/write access to every site the user visits and triggers a manual review.
host_permissions: <all_urls>
How to fix: Narrow to the origins you actually need, or move to the optional_host_permissions + activeTab pattern.
Store review prediction
Manifest V3 forbids remotely-hosted and dynamically-evaluated code. A manifest that relaxes script-src with 'unsafe-eval' is rejected automatically, before a human reviewer looks at the listing.
manifest.json → content_security_policy.extension_pages: script-src 'self' 'unsafe-eval'
How to fix: Drop the relaxed directive and compile the rules engine ahead of time, or ship a WASM/JSON interpreter instead.
Adding "history" to an already-published extension puts it in a disabled state until every existing user manually re-grants the permission. Historically this costs a large share of the active install base.
permissions: +history
How to fix: Move "history" to optional_permissions and request it at runtime from the feature that needs it.
Extensions requesting access to all sites are routed to a manual reviewer, typically adding days to the review queue.
host_permissions: <all_urls>
How to fix: Request specific origins, or use activeTab for click-driven access.
A 41 MB minified bundle with no source map slows down human review and frequently draws a request for reviewable source.
vendor/analytics.bundle.js (41 MB, minified, no source map)
How to fix: Ship a source map or an unminified build alongside the artifact.
Security findings (9 shown)
CRITICALdynamic-code-executionCode vulnerability analysis×3
Dynamic code execution via eval()
- vendor/analytics.bundle.js:1842
- vendor/analytics.bundle.js:2907
- src/background/rules-engine.js:64
confidence: 0.9 category: security
HIGHunsanitized-innerhtmlCode vulnerability analysis×2
Untrusted value assigned to innerHTML
- src/content/panel.js:212
- src/content/tooltip.js:47
confidence: 0.75 category: security
HIGHcsp_unsafe_evalManifest & permission analysis
content_security_policy.extension_pages allows 'unsafe-eval'
- manifest.json
analyzer: manifest
HIGHvulnerable_dependencyKnown-vulnerable dependency detection
Bundled copy of a library version with a known prototype-pollution advisory
- vendor/analytics.bundle.js
category: third_party_library
MEDIUMbroad_host_permissionManifest & permission analysis
Content scripts match <all_urls>, granting access to every site the user visits
- manifest.json
analyzer: permission
MEDIUMfetchNetwork endpoint & exfiltration analysis
http://telemetry.example-vendor.net/collect
- src/background/sync.js
kind: absolute risk_level: medium is_external: true
MEDIUMperiodic_beaconBehavioral & obfuscation analysis
Repeating timer posts collected page data to a remote endpoint
- src/background/sync.js
category: data_exfil confidence: 0.62 is_malicious: false
LOWhigh_entropy_identifiersObfuscation & evasion detection
Machine-generated identifiers throughout the bundle (entropy 4.7)
- vendor/analytics.bundle.js:1
confidence: 0.68 category: obfuscation
LOWscriptNetwork endpoint & exfiltration analysis
https://cdn.example-vendor.net/loader.js
- vendor/analytics.bundle.js
kind: absolute risk_level: low is_external: true
No findings match the current filters.
Coverage — what we checked (8/8 scanners OK)
| Check | Result | Detail |
|---|---|---|
| Code vulnerability analysis | 5 findings | |
| Manifest & permission analysis | 2 findings | |
| Network endpoint & exfiltration analysis | 2 findings | |
| Behavioral & obfuscation analysis | 1 finding | |
| Known-vulnerable dependency detection | 1 finding | |
| Obfuscation & evasion detection | 1 finding | |
| Cryptocurrency & wallet abuse | ✓ clean | no findings |
| Malware signature matching | ✓ clean | no findings |
Go further with a free Extenshi account
This scan ran entirely on your machine. Registering as a developer lets you act on what it found and keep the results going across releases.
- Claim & verify your extension — dispute false positives and raise the public safety score shown on your catalog page.
- Track findings across releases — re-scan on every build and follow the risk trend instead of a single snapshot.
- The full developer toolbox — manifest generator, privacy-policy generator, store-review prediction, and competitive analysis, free to use.
This scan is automated. The scanners are heuristics that may miss real issues or over-flag benign code — a clean result is not a guarantee of safety or store approval. See the security-risk disclaimer.