一句话：提出动态分析框架 ExtPolice，结合 LLM 与多类型污点分析，对 14.9 万个 Chrome 扩展做隐私政策合规检查，发现 2246 个违规扩展。
浏览器扩展凭借复杂权限机制与高特权，可能给用户带来严重隐私风险；而现代网页将敏感个人数据嵌入 HTML 元素，使这类威胁更为隐蔽。已有研究多局限于特定敏感数据源，或只在少数热门网站上测试少量扩展，难以开展大规模合规检查。本文提出自动化动态分析框架 ExtPolice：利用 LLM 技术识别网页中嵌入的敏感内容，在浏览器中执行多类型污点分析以全面追踪跨浏览器组件的敏感数据流，并将这些数据流与扩展隐私政策中的披露进行比对以判定合规性。作者在 7200 个唯一网页上评估了 149216 个 Chrome 扩展，识别出 2246 个存在政策违规的扩展，揭示了可能影响数千万用户的数千项违规行为，表明当前扩展商店的审核流程存在重大缺口。
Browser extensions can pose significant privacy risks to end users due to their complex permission mechanisms and high privilege levels. Modern websites increasingly embed sensitive personal data within HTML elements, making such threats even more insidious. Although prior studies have examined browser extension privacy risks from different perspectives, they are typically constrained to specific sensitive data sources or a set of extensions tested on a few popular websites. To enable a comprehensive compliance check of browser extensions' privacy practices at scale, we develop an automated dynamic analysis framework, ExtPolice. It applies LLM-based techniques to identify sensitive web content embedded in web pages, performs a multi-type taint analysis in the browser to comprehensively track sensitive data flows across browser components, and checks the compliance of such flows against the extension's privacy policy disclosures. We apply ExtPolice to evaluate 149,216 Chrome extensions across 7,200 unique web pages and identify 2,246 extensions with policy violations, enabling scalable analysis of policy compliance for browser extensions. Our study uncovers thousands of policy violations potentially affecting up to tens of millions of users, highlighting major gaps in current extension-store review processes.
@inproceedings{paperbot12469,
title = {When Extensions Lie: Large-Scale Study of Privacy Policy Compliance in Browser Extensions},
author = {Zilun Wang and Zeyang Zhuang and Mingxue Zhang and Wei Meng and Michael R. Lyu},
booktitle = {ASE},
year = {2026},
doi = {10.1145/3832783.3837459}
}