Every listing in the Chrome Web Store and Firefox Add-ons, browsable by what each
extension is allowed to do. A browser extension can read every page you visit, so
the permissions it holds matter as much as the code it ships today — that is the axis this
library is organised on. Ratings are still catching up on Firefox; anything we have not
scanned yet says unreviewed rather than passing itself off as clean.
How to read a grade.Not yet reviewed means exactly that — the
extension is catalogued but we have not analysed it, which is not the same as safe.
Grades come from automated static analysis of an extension's permissions and code: they are a
research signal, not a judgement of the developer's intent.
Capabilities are what an extension declares, not what it does. A
password manager legitimately reads every site and your cookies; so does a session stealer. The
tags describe reach, not wrongdoing — use them to ask whether an extension needs that much
access for what it offers.