Extension Resource Detail View
Click an extension name in any of the Browser Extension reports. This opens the Extension Resource Detail View. This view provides comprehensive information about a single extension resource, including its store identity, per-browser details, declared permissions, and a list of every computer and user where the extension is installed.
The detail view uses the standard resource view layout with multiple tabs. Each tab presents a different aspect of the extension's data.
Identity
Click the Identity tab. The core identifying information for the extension resource is displayed. Identity is the composite resource key and carries three values: Source, Browser, and StoreId. Source is the store the extension came from (Chrome, Edge, Firefox, or Unknown), derived from the extension's manifest update_url. Browser is the browser the extension was discovered running in. StoreId is the manifest ID assigned by the store.
A different combination of any of these three values produces a different resource. For example, uBlock Origin (Chrome) from the Chrome Web Store and uBlock Origin (Firefox) from Firefox AMO are distinct resources, even though they share a name and a publisher.
Details
Click the Details tab. The discovery meta data for the extension resource displays. There is one details row per resource (not per browser). Per-browser breakdowns of actual installations live in the Inventory page, not here. The values in this page come from the extension's manifest and the risk and AI detection engines.
| Column | Description |
|---|---|
| Version | The most recently discovered version of the extension. |
| Author | The extension author or publisher name from the manifest. |
| Name | The raw manifest name of the extension as declared by the extension author. |
| Description |
The extension's description text from the manifest. This typically summarizes what the extension does. |
| Manifest Version | The manifest_version value declared in the extension manifest (2 or 3). |
| Homepage Url | The homepage URL declared in the extension manifest, if the extension provides one. |
| AI Classification | The category assigned by the AI detection engine (for example, Productivity, Developer Tool, or Security). |
| Risk Score | The numeric risk score assigned to the extension. |
| Risk Level | The categorical risk label (Low, Medium, High, or Critical) derived from the risk score. |
The presence of a row in Details means the extension resource has been discovered. Its manifest has been fetched and its risk and AI classifications have been populated. If an Identity row exists but no Details row exists yet, the resource is pending discovery: knows the (Source, Browser, StoreId) combination is in use somewhere in the fleet, but the store-side meta data has not yet been retrieved.
Permissions
Click the Permissions tab. Every permission declared by the extension is displayed. Browser extensions declare permissions in their manifest to request access to browser APIs and web content. extracts and categorizes these permissions to help administrators understand the scope of access each extension requests.
Each permission entry includes:
| Column | Description |
|---|---|
| Permission | The specific permission string as declared in the extension manifest. For API permissions, this is the API name (for example, tabs, storage, webRequest). For host permissions, this is the URL pattern (for example, https://*.example.com/* or <all_urls>). |
| Type | The category of the permission. classifies permissions into four types: RequiredApi, RequiredHost, OptionalApi, and OptionalHost. |
The four permission types are:
-
RequiredApi - An API permission that the extension requires to function. The browser grants this permission automatically when the extension is installed. Examples include: tabs, storage, cookies, webRequest, and activeTab.
-
RequiredHost - A host permission that the extension requires to function. This grants the extension access to read and modify content on matching web pages. The URL pattern defines which sites are accessible. A pattern of <all_urls> grants access to all websites.
-
OptionalApi - An API permission that the extension may request at run time. The browser prompts the user for approval before granting the permission. The extension can function without it.
-
OptionalHost - A host permission that the extension may request at run time. Similar to OptionalApi, the user must approve the request before the extension gains access to matching sites.
Extensions with broad required host permissions (such as <all_urls> or https://*/*) have access to content on every website the user visits. These permissions are a significant factor in risk score calculation because they enable the extension to read sensitive data from any page, including internal corporate applications, email, and banking sites.
Inventory
Click the Inventory tab. Every computer and user where this extension is currently installed is listed. This provides the same data as the Computers with Browser Extension drill-down report, but scoped to the extension you are viewing and accessible directly from the detail view.
-
Inventory answers the following questions.
-
How many endpoints have this extension installed?
-
Which users installed this extension?
-
Is this extension installed via the web store, side loaded, or pushed by enterprise policy?
-
What version of this extension is running on each machine?
The inventory data updates as agents report new scan results, so it reflects the most recent state of extension installations across the fleet.
Planned Enhancements
The current Detail view uses the standard resource view layout. A custom detail view is planned for a future release that will include:
-
Itemized risk score breakdown showing the individual factors that contribute to the overall risk score.
-
AI signal explanations describing why the AI detection engine assigned its classification.
-
Grouped permissions display that organizes permissions by category and highlights the most security-relevant permissions.
These enhancements will provide deeper insight directly within the detail view without requiring administrators to cross-reference multiple reports.
