Extensions run in a hostile browser with messy messaging boundaries. If your message passing, permissions, or origin validation is weak, malicious sites will drain users—fast.
Content scripts and DOM interaction surfaces
Background/service worker logic and message passing
Permission model and origin validation
Storage and secret handling
Update and integrity assumptions
Transaction simulation and signing UX
origins, contexts, privileges
malicious sites and injected content scenarios
simulation/preview correctness
updates, dependencies, and permissions
user-loss narratives and high-priority fixes
Origin/message bugs with concrete repro
High-risk permission and storage findings
Fix direction focused on isolation and validation
Retest confirmation
Frequently Asked Questions
We audit browser extensions (MetaMask-style) for security: permission scopes, phishing resistance, UI spoofing, content script isolation, and dApp communication. Extensions have elevated privileges—bugs are catastrophic.
We verify that the extension only requests necessary permissions and doesn't over-scope (like requesting "access all websites" when only specific sites are needed). Over-permissioned extensions are surveillance and attack vectors.
Malicious sites can overlay fake wallet popups to trick users into revealing seed phrases or signing bad transactions. We test whether the extension's UI is distinguishable from phishing overlays.
Permission scope issues, phishing vectors, content script vulnerabilities, message passing bugs, hardware wallet integration flaws, and remediation guidance.
We verify that communication between the extension and dApps is authenticated, secure from interception by other extensions, and does not leak sensitive data. Message passing is a critical attack surface.
Yes—we simulate malicious dApps attempting to exploit extension weaknesses. If fund-drain or key-theft scenarios are possible, we document the full attack path and impact.
Yes—we assess whether hardware wallet interactions are properly isolated, whether transaction details are accurately displayed on the device, and whether the extension can bypass hardware-level protections.
$10K–$25K depending on extension complexity.
A blockchain security audit firm with the goal of making the Web3 space more secure through innovative and effective solutions.
