CVE Scanner

A WebExtension that scans your browser and installed extensions against a public CVE database. Matching runs locally — your list of extensions never leaves your browser.

How it works

When you click the toolbar icon:

1. The extension fetches a CVE database from https://borisyamp.github.io/cve-scanner/cve-data.json (served by GitHub Pages, regenerated every 6 hours by a GitHub Action).
2. The result is cached in chrome.storage.local for 6 hours; subsequent scans use the cache. There's a manual refresh button.
3. Locally — in your browser, without sending anything to a server — the extension:
   • Reads navigator.userAgent to detect your browser and version.
   • Calls chrome.management.getAll() to read your installed extensions.
   • Matches both against the bundled CVE list.
4. Shows you what's vulnerable, with CVSS scores and links to the source advisory.

Privacy

Goes out over the network	Stays on your machine
GET https://borisyamp.github.io/cve-scanner/cve-data.json	Your browser version
(with conditional headers — usually 304 Not Modified after the first time)	Your installed extension list
	Anything else

Things to know:

• The manifest only requests two permissions: management (to read your extension list) and storage (for caching). The only host_permissions entry is https://borisyamp.github.io/* — see manifest.json. The extension is technically incapable of contacting any other server.
• GitHub Pages logs your IP and timestamp when you fetch cve-data.json. The author of this extension does not have access to those logs — GitHub doesn't expose Pages access logs to repo owners. The CVE database itself is a public file that anyone can mirror.
• The source is in this repo. Audit it. Compare the loaded extension to the source tree.

Install

Chrome / Edge / Brave / Opera (Manifest V3)

1. git clone this repo or download a release.
2. Open chrome://extensions (or edge://extensions, brave://extensions, …).
3. Toggle Developer mode in the top right.
4. Click Load unpacked and select the repo folder.

Firefox

1. git clone this repo or download a release.
2. Open about:debugging#/runtime/this-firefox.
3. Click Load Temporary Add-on… and select manifest.json.
4. Note: temporary add-ons disappear when Firefox restarts. For permanent install you'd need to ship through AMO with a signing review.

Tor Browser

Same as Firefox above, with one config tweak: open about:config and set xpinstall.signatures.required to false.

Important: running any extension in Tor Browser weakens its anonymity protections — every extension contributes to a unique browser fingerprint. If you install CVE Scanner in Tor, the popup will show you a yellow notice. Disable or remove it after use.

Architecture

.
├── manifest.json              — extension manifest (MV3; permissions: management, storage)
├── popup.html / popup.js / popup.css
├── cve-data.json              — bundled CVE database (last-resort fallback)
│
├── tools/
│   ├── update-cve-data.js         — refreshes browser CVEs from NVD 2.0 API
│   ├── update-extension-cves.js   — refreshes extension CVEs from GitHub
│   │                                  Security Advisories + NVD
│   └── extension-mapping.json     — curated map: Chrome-Web-Store ID → source
│
└── .github/workflows/
    └── update-cve-data.yml        — cron every 6h, commits cve-data.json

The data flow is:

NVD ─┐
     │     (GitHub Action, every 6h)
GitHub ─┤───────── cve-data.json ─────────► GitHub Pages
Advisories     │
               └──► committed to main
                                        ┌── fetch ──► browser cache
                                        │              (6h TTL)
                              user clicks ─► popup.js matches locally

GitHub Pages serves the JSON file with cache headers; the extension uses conditional GETs (If-None-Match) so most refreshes are 304 with zero body.

Updating the CVE database manually

For local testing without waiting for the Action to fire:

node tools/update-cve-data.js
node tools/update-extension-cves.js

Both scripts respect NVD_API_KEY and GITHUB_TOKEN env vars for higher rate limits. Neither is required.

Adding extensions to track

Edit tools/extension-mapping.json:

"<chrome-web-store-id>": {
  "name": "<Human-readable name>",
  "github_repo": "owner/repo",         // optional, queries GH Security Advisories
  "cpe_vendor": "vendor",              // optional, queries NVD by CPE
  "cpe_product": "product"
}

Find a Chrome extension's ID by opening chrome://extensions with Developer mode on — it's listed under each entry.

If an extension has neither a public source repo nor an NVD CPE entry, there's no automated way to track its CVEs. Add a manual entry by directly editing the extensions array in cve-data.json after a generator run.

Known limitations

• Linux distro browsers sometimes backport security fixes without bumping the version string (e.g. firefox-esr-128.5.0-1ubuntu0.22.04 includes the CVE-2024-9680 fix, but the version reads as 128.5.0). The scanner will flag these as vulnerable. Tell users this in the popup footer.
• Sideloaded extensions (developer mode, enterprise policy, .crx from outside the Web Store) have non-CWS IDs and won't match any database entry. The scan reports them as "skipped".
• Tor anonymity is weakened by every installed extension, including this one. The popup shows a warning when run under Tor.

License

MIT.