Chrome Extensions

Overview

Evidence: Chrome Extensions Description: Collect Chrome Extensions Category: Browser Platform: Linux Short Name: chrext Is Parsed: Yes Sent to Investigation Hub: Yes Collect File(s): No

Background

Chromium-based browser extensions extend functionality and can be abused for persistence, credential theft, tracking, or data exfiltration. Manifest metadata and permissions offer insight into capabilities and risk.

Data Collected

This collector gathers structured data about chrome extensions.

Chrome Extensions Data

Field	Description	Example
ID	ID	1
UID	UID	Example value
BrowserType	Browser Type	Example value
LastChromeVersion	Last Chrome Version	1.0.0
Name	Name	Example Name
FromWebstore	From Webstore	true
Description	Description	Example value
Version	Version	1.0.0
CurrentLocale	Current Locale	Example value
DefaultLocale	Default Locale	Example value
UpdateURL	Update URL	2023-10-15 14:30:25
Author	Author	Example value
Persistent	Persistent	true
ExtensionPath	Extension Path	/path/to/file
Username	Username	Example Name
Profile	Profile	Example value
ProfilePath	Profile Path	/path/to/file
State	State	Example value
Key	Key	Example value
Permissions	Permissions	Example value
OptionalPermissions	Optional Permissions	Example value
ManifestHash	Manifest Hash	a1b2c3d4...
ManifestPath	Manifest Path	/path/to/file
Identifier	Identifier	com.example.app
InstallTime	Install Time	2023-10-15 14:30:25
InstallTimestamp	Install Timestamp	2023-10-15 14:30:25

Collection Method

This collector discovers profile Preference files, parses extension configuration, locates each extension's manifest.json, copies artifacts to case content, and normalizes extension metadata (permissions, version, author, install time).

Usage

Extension inventories help identify malicious or risky add-ons, correlate with browser activity, and detect persistence mechanisms. Permissions and update URLs aid threat hunting and attribution.

Notes

This data may contain sensitive information that should be handled according to data protection requirements. Ensure proper chain of custody is maintained during collection and analysis.