CTR DOCs DEEP DIVE

← Back to Sections

Understanding Extension Detection

For security and privacy, browsers prevent websites from directly listing a user's installed extensions. However, a site can use indirect methods to probe for the presence of *specific* extensions. This is often done to detect ad blockers or to identify potentially conflicting add-ons.

Early 2010s: Resource Probing becomes common.
Mid 2010s: DOM Alteration detection grows with the rise of interactive extensions.
Late 2010s - Present: Behavioral analysis becomes more sophisticated as browsers harden direct probing.

Method 1: Resource Probing

This is one of the oldest and most common methods. Every Chrome extension has a unique ID and can bundle resources (images, scripts, CSS). A website can try to fetch a known resource URL from a popular extension. If the resource loads, the extension is installed.

Finding Extension IDs and Resource Paths

A developer must first identify the extension's unique 32-character ID (found in its Chrome Web Store URL) and a stable internal file path (e.g., `/images/icon16.png`), which is found by examining the extension's source code.

// Probing for an extension by trying to load a known resource
const probe = document.createElement('img');
probe.src = 'chrome-extension://{extension_id_here}/path/to/resource.png';
probe.onload = () => console.log('Extension is likely installed.');
probe.onerror = () => console.log('Extension is likely NOT installed.');
Defensive Measures: Modern browsers now heavily restrict or block web pages from accessing `chrome-extension://` resources.

Method 2: DOM Alteration Detection

Many extensions modify the Document Object Model (DOM). A website can detect this by checking for these changes, such as an icon injected by a password manager.

// Check if a password manager added an element next to an input field
const passwordInput = document.getElementById('password');
if (passwordInput.nextElementSibling) {
  console.log('An extension may have modified the DOM.');
}
Defensive Measures: Extensions increasingly use the Shadow DOM to encapsulate their modifications, making them invisible to page scripts.

Resources and Further Reading