Docs

Inspect a published extension ​

An extension is in a store and you want to know what it actually does before it runs in your browser: yours before a release, a dependency before you recommend it, a stranger's before you install it.

Paste its store listing URL into inspect.extension.dev. Chrome Web Store, Edge Add-ons, and Firefox AMO listings all resolve. Each inspection also has a canonical address:

https://inspect.extension.dev/extension/<chrome|edge|firefox>/<id>

The extension is fetched through an allowlisted relay, unpacked, and run in the emulator. Nothing installs in your browser.

The containment ​

The code under inspection is by definition code you do not trust, so it runs on a one-off cross-site origin, out of process. Hostile code never shares the inspector's origin: it cannot read the page you are looking at, and each inspection's origin dies with it.

The four panels ​

PanelWhat it answers
ManifestThe manifest, parsed, with per-browser divergence where the listing ships different answers to different browsers
PermissionsEach permission and host pattern, annotated with what it unlocks
SurfacesPopup, options, side panel, content scripts, and service worker, running
TraceEvery chrome.* call as it happens, while you drive the surfaces

Trace is the panel that settles arguments. A listing can describe itself however it likes; the trace is what the code did while you watched.

When it fails ​

  • The listing URL does not resolve: the store page is regional, delisted, or not a listing at all. Use the canonical /extension/<browser>/<id> form with the id from the store URL.
  • A surface renders blank: some extensions gate their surfaces on state an emulator cannot hold, such as a signed-in session. The trace still shows what the code attempted.
  • The fetch is refused: the relay only speaks to the allowlisted stores. A zip from anywhere else belongs in preview, loaded from disk.

Next ​