CRX Extractor

The CRX Extractor analyzes Chrome extension package files (.crx) to surface manifest data, permissions, and signature information for developers, security researchers, QA teams, and auditors who evaluate extensions prior to deployment or purchase. It operates as a read-only analyzer that does not install or execute the extension.
Conceptually, the tool parses the CRX header (supporting both v2 and v3), unpacks the embedded ZIP payload, and reads manifest.json to expose essential fields such as name, version, icons, description, permissions, host_permissions, content_scripts, background and options pages. It then computes the extension_id from the public key (SHA-256) to help verify provenance and detects whether the extension provides a valid signature status. The value lies in providing a concise, auditable snapshot that informs security reviews, policy compliance, and risk assessment.
Beneficiaries include developers validating their own packages, security researchers auditing third-party extensions, QA teams validating release readiness, and procurement teams assessing store submissions. Core features include manifest extraction, permission mapping, key presence checks, and a structured, exportable report suitable for CI workflows. The tool emphasizes accuracy, reproducibility, and transparency, enabling quick comparison across multiple CRX samples and integration with other analysis pipelines.