Your browser extensions update themselves at night. ExtWatch reads the diff so you don't have to.
An extension you installed years ago is not the extension running today. Extensions get sold, developer accounts get phished, and the next silent update turns a screenshot tool into spyware. QuickLens did exactly that in 2026: kept its features, added a five-minute poll to a server for JavaScript to run on every page. The Great Suspender, Nano Adblocker, Stylish and the 35 extensions of the Cyberhaven wave went the same way. The browser shows nothing, because nothing about the update looks wrong to the browser.
ExtWatch is a small tray app for macOS, Windows and Linux that watches what your extensions actually do, version after version, on your own machine.
- Sees every install - Chrome, Chromium, Edge, Brave, Vivaldi, Opera and Arc, every profile, read straight from the browser's own files.
- Keeps every version - content-addressed archive, so a hundred versions of a 5 MB extension cost a few MB. Export any of them as a zip.
- Catches silent updates in seconds - a file watcher per profile, plus rescans on start and every 15 minutes. Versions that are downloaded but not yet running are reported first.
- Explains the change - the code is parsed, reduced to a behavior signature, and diffed against the previous version. Fifty-one rules turn the difference into findings a normal person can read, and anything the analyzer could not inspect is reported rather than passed off as clean.
- Shows the code - side by side, prettified, highlighted, with each finding linked to its line.
- Lets you act - one-click Disable through a tiny companion extension, quarantine, export, share a report.
- Local only - no account, no server, no telemetry. The one optional network feature is off by default.
- Discover - find every user data directory and profile, list the extensions and read
Secure Preferencesfor the active version and enabled state. - Snapshot - hash every file, store new blobs in the archive, record the version and its manifest in SQLite. The first snapshot of an extension is its baseline.
- Watch - a file-system watcher on each profile notices the new
Extensions/<id>/<version>/directory the moment the browser writes it. - Analyze - both versions are parsed with tree-sitter: domains it talks to,
chrome.*APIs, code run from strings, storage read next toeval, header-stripping rules, keystroke listeners, fingerprinting reads, obfuscation. - Explain - the rules compare the two signatures and produce findings with a severity, a
sentence, and a
file:line. - Show - a tray notification with the one-line summary, and a window with the findings, the manifest diff and the code diff.
You need CMake, Ninja, a C++20 compiler and Qt 6. On a Mac, brew install qt cmake ninja is enough.
git clone https://github.com/kanishka0411/extWatch.git
cd extWatch
cmake --preset dev-mac # dev-linux on Linux, ci-windows on Windows
cmake --build --preset dev-mac
./build/dev-mac/src/extwatch --showTo run it from anywhere as plain extwatch, install it once:
sudo cmake --install build/dev-mac
extwatch --showIt sits in the tray. The first scan records every extension as a baseline; after that you only
hear about changes. The same binary is the command line: extwatch --help.
packaging/macos/build-dmg.sh builds a normal ExtWatch.app you can drag into Applications.
MIT