ScopeCreep

Scores your installed extensions against what they claim to do, and tells you when one quietly asks for more.

Date: 2026-08-15 Form factor: Browser extension (Manifest V3) Browser surface: content script (Chrome Web Store product pages), toolbar popup, chrome.management, chrome.storage, chrome.alarms Status: Prototype

What it is

ScopeCreep reads the permission list of every other extension in your browser, guesses what each one is supposed to do from its name and description, and flags the ones asking for more than that job needs. A background check re-scans on an interval and remembers each extension's last permission set, so if one gains a new permission after an update, ScopeCreep notices even if you never open the popup. A content script does the same check one step earlier, on the Chrome Web Store listing itself, before you click Add to Chrome.

Why it has to be an extension

The core data source is chrome.management.getAll(), which lists every extension installed in the browser along with its permissions — no website can see that list, and no other extension can either unless it asks for the same permission. Reading it, storing snapshots over time, and diffing them on a schedule are all things that only happen inside the browser process itself. The Store-page banner is a content script reading a page's live DOM the moment you land on it, before any install decision is made.

Who it serves

Individually: people who install extensions the way most people do (a quick search, a plausible name, "Add to Chrome") and have no way to check afterward whether one of them asks for more than its job requires. For teams: an IT or security lead who has to answer, this week, which extensions across the company's managed Chrome fleet request permissions their stated purpose doesn't call for.

Why it could be profitable

Free tier: manual scans, risk scores for up to 5 installed extensions. Paid tier (roughly $3.99/mo or $24/yr): unlimited extensions, the background auto-rescan, the full permission-change timeline, and a CSV export aimed at IT teams doing exactly this kind of audit across a managed fleet. That B2B export is the more defensible revenue line — a security team auditing dozens of employee machines is a much easier sell than an individual paying a few dollars a month to check their own extensions once and forget about it.

The timing is specific, not just generally relevant. Chrome Web Store's updated developer policies took effect August 1, 2026, closing the loophole that let extensions collect data outside their stated single purpose; anything still out of line risks removal. On the incident side, ModHeader, an extension with roughly 1.6 million combined Chrome and Edge installs, had its store listing pulled in July 2026 after researchers found a dormant data-collection capability sitting inside permissions it already held, gated by an empty allowlist so no new permission request ever appeared. That detail matters for what this tool can and can't promise. ScopeCreep's permission-change alert would not have caught that specific case, because nothing new was requested. What it does catch is the far more common pattern: a permission set that was already too broad for the extension's stated purpose from day one, plus any future extension that does ask for more.

How to load it in Chrome

1. Open chrome://extensions and turn on Developer mode.
2. Click Load unpacked and select this folder's extension/ directory.
3. Open the popup — it scans your real installed extensions immediately. Visit any chromewebstore.google.com/detail/... product page to see the inline risk banner.

How to try the demo

1. Open index.html in any modern browser. No server is needed — the page carries an inline copy of sample-data.json for browsers that block fetch() on file://.
2. Click the SC button in the mock toolbar to open the popup and see the scored extension list; click any row to expand its permission detail and change history.
3. The mock page underneath is a stand-in Chrome Web Store listing — the risk banner above its title simulates what extension/content.js would inject on a real product page.

The demo can't run chrome.management.getAll() or a real background alarm, so the popup and the mock page both read from sample-data.json instead of live browser state — that's the one difference from loading the real extension.

Permissions, and why each one

What's in this prototype

• A background service worker that scans installed extensions via chrome.management, scores each against a small set of category-to-permission rules, and diffs the result against the last snapshot in chrome.storage.local
• A toolbar popup listing every scored extension, sorted riskiest first, with a badge on rows whose permissions changed since the last scan
• A content script for Chrome Web Store product pages that scrapes the visible permission list and injects a risk banner before the Add to Chrome button
• A shared risk heuristic: sensitive permissions (tabs, webRequest, cookies, history, management, <all_urls>, and similar) weighted against an expected set inferred from the extension's name and description
• A toolbar badge count and a "recently checked on the Store" list in the popup, both fed by messages from the content script
• A demo harness with 14 sample installed extensions and one mock Store listing, covering the full range from clean to flagged

Roadmap

• Recognize more categories — the current rule set misses common ones like developer tools and browser-header utilities, which is exactly the category the ModHeader incident fell into
• Detect risk from permission combinations, not just individual permissions, since tabs plus webRequest together is a different signal than either alone
• A managed-fleet view for the paid tier, aggregating scan results across a Google Workspace or Chrome Enterprise deployment
• Weekly email or Slack digest of anything newly flagged, instead of requiring someone to open the popup
• Cross-reference each extension's permissions against its actual Chrome Web Store privacy disclosure, not just its name and description

Sources

• Chrome Extensions Face New Data Privacy Rules Starting August 1 — DigitBin — the Limited Use Policy, disclosure requirements, and removal risk that took effect August 1, 2026
• Chrome Extension Used by 1.6 Million Users Silently Adds Data Exfiltration Capabilities — Cyber Security News — the ModHeader incident, including the detail that the collection code activated without any new permission request