Meta Pixel HelperSecurity Analysis

Chromev4.0.0MV3February 16, 2026 at 03:23 PM
9.8CRITICAL
9.8 CRITICAL

This extension shows critical risk indicators. It requests highly sensitive permissions combined with suspicious code patterns. Proceed with extreme caution.

Based on 13 permissions including high-risk ones, 80 code findings, 3 dangerous combinations.

Dangerous Combinations(3)

CRITICALCookie access + external network

Extension has cookie access and sends data to external servers — potential session token theft.

cookies+external network request
HIGHTab tracking + external communication

Extension tracks open tabs and communicates with external servers — potential browsing surveillance.

tabs+external network request
CRITICALNetwork interception + external communication

Extension intercepts network traffic and sends data externally — potential man-in-the-middle behavior.

webRequest/webRequestBlocking+external network request
Permissions
10.0/10
Code
10.0/10
Combinations
10.0/10
Manifest/CSP
7.8/10

Permissions(13 analyzed)

Code Findings(19 patterns, 80 total)

Libraries(4 detected)

4 libraries detected

Content Security Policy

No CSP Defined(1 issue)
MEDIUM
N/ANo CSP defined

This extension does not define a Content Security Policy. A CSP helps prevent XSS and code injection attacks.

Manifest Analysis(4 findings)

Resolved from __MSG_* i18n placeholders:

Name: Meta Pixel Helper

Description: The Meta Pixel Helper is a troubleshooting tool that helps you validate your pixel implementation.

HIGH
web_accessible_resourcesJS files exposed to web pages

JavaScript files are accessible to ALL websites. Any page can load and interact with these scripts, enabling web→extension attacks.

MEDIUM
web_accessible_resources.matchesOverly broad match patterns

Web-accessible resources use <all_urls> or wildcard patterns, exposing resources to every website.

LOW
externally_connectableExternal messaging enabled

Extension accepts messages from 2 external pattern(s). Verify these are trusted origins.

MEDIUM
content_scriptsContent script injected on all URLs

Content script matches <all_urls>, executing on every website the user visits.

External Domains(17)

analytics.google.combusiness.facebook.comchromewebstore.google.comconnect.facebook.netdevelopers.facebook.comelectronjs.orgeventsmanager.facebook.comgithub.comgraph.facebook.comhtml.spec.whatwg.orglocalhostreactjs.orgunderscorejs.orgw3c.github.iowww.andismith.comwww.facebook.comwww.my-od.facebook.com

Indicators of Compromise

71 indicators of compromise found

File Statistics

72
Total Files
11
JS Files
4.6 MB
Total Size

Other Scanned Extensions