Chrome Extension Security Risk Scraper

This Actor collects public Chrome Web Store extension listing data and derives a transparent, heuristic security-triage signal from structured manifest permissions and the developer’s own privacy disclosures. It does not inspect installed software, execute extensions, or perform a security audit.

What it collects

Each normal dataset row represents one extension. The rich output includes:

• Listing identity, canonical extension URL, title/name, category, full Overview text, safe formatted HTML, and short description.
• Publisher name, Offered by value, website, email(s), phone, postal address components, D-U-N-S identifier, trader status, and publisher trust badge when shown.
• Rating and rating count, user count, extension version, manifest version, last-updated text/date, size, language count/list, in-app-purchase feature, icon, and screenshots when present.
• Required and optional API permissions; required and optional host patterns; content-script matches; readable permission details when the source has a dedicated permission section; evidence objects and evidence completeness.
• Developer privacy-section text, privacy-policy link, collection/use declaration, third-party sale declaration (including qualified exceptions), unrelated-use and creditworthiness declarations.
• Related extension IDs, titles, and canonical URLs scoped to the listing’s Related section.
• Risk score, level, factors, assessment status, and method. When structured permission evidence is absent, the score is null, the level is insufficient_evidence, and site access is unknown—not “low risk.”

The dataset includes the public extension listing, permission evidence, privacy disclosures, related extensions, and the risk assessment. Missing or unavailable source information is not filled with guesses.

Source coverage and limits

Provide extension IDs or official detail URLs for specific extensions, or search/category URLs to discover candidates. This Actor reads the initial search/category page only; the Chrome Web Store's additional results load interactively, so page and maxPages must remain at 1. Permission information is included only when structured public declarations are available; it is not inferred from advertising text.

Input

Provide an extension ID in extensionIds, public URLs in startUrls, or search terms in queries (query or searchQuery for one term). Example:

{
  "extensionIds": ["cjpalhdlnbpafiamejdnhcphjbkeiagm"],
  "maxItems": 5,
  "maxDetailRequests": 5,
  "maxRequests": 10,
  "page": 1,
  "maxPages": 1
}

Supported URL routes are Chrome Web Store detail, search, and category pages. maxItems limits extension records and maxDetailRequests limits detail pages. Only the initial public search/category page is supported.

Output and dataset

Each dataset row represents one extension. The 💼 Security Risk Overview, 🔐 Permissions and Host Access, ⚠️ Risk Explanation and Privacy, and 🔍 Listing and Publisher Details views help you browse the results.

The dataset and run summary are available in the Output tab. You can download dataset records in formats such as JSON, HTML, CSV, or Excel. If a page is blocked, empty, malformed, or unavailable, it is reported in the run summary and logs rather than added as an extension record.

Limits and responsible use

The Actor reads public Web Store pages only. It does not sign in, bypass access controls, solve CAPTCHAs, or resolve privacy-policy sites. Risk weights are heuristic and uncalibrated; they are intended only for triage and must not be treated as a security verdict, malware finding, or endorsement.

An ID or detail-URL lookup normally uses one detail request per extension. Search/category inputs use a listing request plus detail requests for discovered extensions. Retries count toward maxRequests; compute and platform usage depend on the requested records and current Apify plan. Start with a small maxItems and request budget when evaluating the Actor.

For questions or product feedback, use the Actor’s Apify support/issues channel.