Chrome Web Store Intelligence & Permission-Risk Scraper

Scrape any Chrome Web Store extension — ratings, user counts, versions, developer, category, size, languages, and the full manifest permission list — plus a 0–100 permission-risk score that no other Chrome Web Store scraper on Apify gives you. $2.40 / 1,000 extensions. HTTP-only, no login, no API key, no browser.

Who this is for

• Extension developers tracking competitor ratings, user growth, versions, and update cadence.
• Security & IT teams auditing which extensions request broad host access, cookies, debugger, nativeMessaging, or other sensitive permissions — before allowing them in the org.
• Acquirers & investors screening extensions by users, rating, freshness, and abandonment risk.
• Market researchers mapping a whole category (productivity, privacy, AI, …) in one run.

What makes it different

Most Chrome Web Store scrapers give you a listing snapshot. This one adds a transparent permission-risk model:

• Extracts permissions, host_permissions, and optional_permissions straight from the extension's embedded manifest (handles both Manifest V2 and V3).
• Scores each extension 0–100 by how much user-data exposure and system control it requests: broad host access (<all_urls>, *://*/*), debugger, nativeMessaging, proxy, management, cookies, webRequest, history, tabs, scripting, and more.
• Labels every extension low / medium / high / critical and lists human-readable risk flags (broad_host_access, reads_cookies, injects_scripts, …) so you can see why.
• Flags abandoned extensions (no update in over a year) — a common security and quality red flag.

The weights are documented and auditable; nothing is a black box.

Three ways to choose extensions

1. Extension URLs or IDs — paste Chrome Web Store URLs or bare 32-character IDs.
2. Search queries — every extension on the results page is discovered and scraped.
3. Categories — enumerate a category path such as extensions/productivity/tools or extensions/lifestyle.

Mix all three in one run. maxExtensions caps the total.

Fair, predictable pricing

You pay $0.0024 per extension pushed ($2.40 / 1,000) plus a $0.01 actor start.

• Extensions removed by your filters (minUsers, minRating, onlyRiskLevels, requireBroadHostAccess) are never pushed, so never charged.
• Duplicate IDs across your inputs are de-duplicated and charged once.
• Not-found or unparseable extensions are skipped and not charged.

Output (one row per extension)

Field	Example
extensionId	ddkjiahejlhfcafbddmgiahcphecmpfh
name	uBlock Origin
url	https://chromewebstore.google.com/detail/…
developer / developerEmail	Raymond Hill (gorhill) / ubo@…
category	privacy
rating / ratingCount	4.7 / 35450
userCount	11000000
version	1.74.0
lastUpdatedAt / lastUpdatedDays	2026-08-25T16:03:53Z / 0.3
isAbandoned	false
size	4.38MiB
manifestVersion	3
apiPermissions	["scripting","tabs","cookies"]
hostPermissions	["https://*/*"]
permissionRiskScore	86
riskLevel	critical
riskFlags	["broad_host_access","reads_cookies"]
hasBroadHostAccess	true

A SUMMARY record (in the run's key-value store) rolls up the run: extension count, average rating, risk-level distribution, broad-host-access count, abandoned count, and the most common permissions.

Example input

{
  "searchQueries": ["password manager"],
  "categories": ["extensions/productivity/tools"],
  "maxExtensions": 200,
  "minUsers": 10000,
  "onlyRiskLevels": ["high", "critical"]
}

This returns only the higher-risk, reasonably-popular extensions across the search and the category — the exact shortlist a security reviewer wants.

How to schedule this actor (run it on autopilot)

Extension ratings, user counts, versions, and permissions change constantly — and new extensions appear every day. Put this actor on a schedule so you always have fresh intelligence:

1. Open the actor in Apify Console and click Schedules (or go to Schedules → Create new).
2. Add this actor and pick a cadence — daily is ideal for tracking a category or a competitor set.
3. Save your input (your watchlist of IDs, search queries, or categories) as a task, then attach the task to the schedule.
4. Connect the dataset to Google Sheets, Slack, or a webhook via Integrations to get a fresh report or an alert whenever a tracked extension changes version, spikes in users, or adds a risky permission.

A daily schedule over a fixed watchlist lets you diff runs and catch permission changes the moment they ship.

Notes

• HTTP-only, no residential proxy. Every field comes from the public detail, search, and category pages — no login, no token, no headless browser.
• Polite by default. A configurable delay (politenessMs) sits between requests.
• Reviews text is intentionally out of scope — this actor is about listing intelligence and permission risk. Developer replies and full review corpora are not published by the Chrome Web Store the way they are on Google Play, so we don't fabricate them.