CRX-ray: large-scale detection of API key leakage in browser extensions

Wei Zeng; Zhi Wang; Valerio Bucci; Xiaoyu Chen; Xin Yang; Siyu Zhang; Yuejun Guo; Wanpeng Li

doi:10.1145/3779208.3785378

CRX-ray: large-scale detection of API key leakage in browser extensions

Wei Zeng
, Zhi Wang^*
, Valerio Bucci^*
, Xiaoyu Chen
, Xin Yang
, Siyu Zhang
, Yuejun Guo
, Wanpeng Li

^*Corresponding author for this work

School of Electronics, Electrical Engineering and Computer Science

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution

2 Downloads (Pure)

Abstract

The rapid proliferation of AI-enabled browser extensions has introduced significant security vulnerabilities. These client-side applications, distributed with exposed source files, frequently embed API keys from AI platforms - credentials designed to track usage for billing and prevent misuse. The exposure of these API keys poses substantial financial and operational risks to extension developers. This study presents the first comprehensive security analysis of API key leakage in browser extensions. We systematically analyzed 163,924 extensions across Chrome, Firefox, and Edge stores, uncovering 3,677 unique leaked API keys across 4,145 extensions. Most critically we identified 300 exposed AI platform keys across 309 extensions that collectively serve 1,045,339 users. Furthermore, our analysis reveals prominent reuse of API keys across different extensions, along with instances of multiple keys being used by single extensions. In this paper, we introduce the CRX-ray detection framework to identify API key leakage in browser extensions. By open-sourcing CRX-ray, we aim to empower developers to identify and mitigate API key leakage, fostering the development of more secure browser extensions that protect both developers and users.

Original language	English
Title of host publication	ASIA CCS '26: Proceedings of the ACM Asia Conference on Computer and Communications Security
Publisher	Association for Computing Machinery
Pages	1200-1212
Number of pages	13
ISBN (Electronic)	9798400723568
DOIs	https://doi.org/10.1145/3779208.3785378
Publication status	Published - 04 Jun 2026

Access to Document

10.1145/3779208.3785378Licence: CC BY

CRX-ray: large-scale detection of API key leakage in browser extensions
Copyright 2026 the authors. This is an published under a Creative Commons Attribution License (http://creativecommons.org/licenses/by/4.0/.), which permits unrestricted use, distribution and reproduction in any medium, provided the author and source are cited.
Final published version, 760 KBLicence: CC BY

Cite this

@inproceedings{c492cb7cf47242fea753779629e136e9,

title = "CRX-ray: large-scale detection of API key leakage in browser extensions",

abstract = "The rapid proliferation of AI-enabled browser extensions has introduced significant security vulnerabilities. These client-side applications, distributed with exposed source files, frequently embed API keys from AI platforms - credentials designed to track usage for billing and prevent misuse. The exposure of these API keys poses substantial financial and operational risks to extension developers. This study presents the first comprehensive security analysis of API key leakage in browser extensions. We systematically analyzed 163,924 extensions across Chrome, Firefox, and Edge stores, uncovering 3,677 unique leaked API keys across 4,145 extensions. Most critically we identified 300 exposed AI platform keys across 309 extensions that collectively serve 1,045,339 users. Furthermore, our analysis reveals prominent reuse of API keys across different extensions, along with instances of multiple keys being used by single extensions. In this paper, we introduce the CRX-ray detection framework to identify API key leakage in browser extensions. By open-sourcing CRX-ray, we aim to empower developers to identify and mitigate API key leakage, fostering the development of more secure browser extensions that protect both developers and users.",

author = "Wei Zeng and Zhi Wang and Valerio Bucci and Xiaoyu Chen and Xin Yang and Siyu Zhang and Yuejun Guo and Wanpeng Li",

year = "2026",

month = jun,

day = "4",

doi = "10.1145/3779208.3785378",

language = "English",

pages = "1200--1212",

booktitle = "ASIA CCS '26: Proceedings of the ACM Asia Conference on Computer and Communications Security",

publisher = "Association for Computing Machinery",

address = "United States",

}

TY - GEN

T1 - CRX-ray: large-scale detection of API key leakage in browser extensions

AU - Zeng, Wei

AU - Wang, Zhi

AU - Bucci, Valerio

AU - Chen, Xiaoyu

AU - Yang, Xin

AU - Zhang, Siyu

AU - Guo, Yuejun

AU - Li, Wanpeng

PY - 2026/6/4

Y1 - 2026/6/4

N2 - The rapid proliferation of AI-enabled browser extensions has introduced significant security vulnerabilities. These client-side applications, distributed with exposed source files, frequently embed API keys from AI platforms - credentials designed to track usage for billing and prevent misuse. The exposure of these API keys poses substantial financial and operational risks to extension developers. This study presents the first comprehensive security analysis of API key leakage in browser extensions. We systematically analyzed 163,924 extensions across Chrome, Firefox, and Edge stores, uncovering 3,677 unique leaked API keys across 4,145 extensions. Most critically we identified 300 exposed AI platform keys across 309 extensions that collectively serve 1,045,339 users. Furthermore, our analysis reveals prominent reuse of API keys across different extensions, along with instances of multiple keys being used by single extensions. In this paper, we introduce the CRX-ray detection framework to identify API key leakage in browser extensions. By open-sourcing CRX-ray, we aim to empower developers to identify and mitigate API key leakage, fostering the development of more secure browser extensions that protect both developers and users.

AB - The rapid proliferation of AI-enabled browser extensions has introduced significant security vulnerabilities. These client-side applications, distributed with exposed source files, frequently embed API keys from AI platforms - credentials designed to track usage for billing and prevent misuse. The exposure of these API keys poses substantial financial and operational risks to extension developers. This study presents the first comprehensive security analysis of API key leakage in browser extensions. We systematically analyzed 163,924 extensions across Chrome, Firefox, and Edge stores, uncovering 3,677 unique leaked API keys across 4,145 extensions. Most critically we identified 300 exposed AI platform keys across 309 extensions that collectively serve 1,045,339 users. Furthermore, our analysis reveals prominent reuse of API keys across different extensions, along with instances of multiple keys being used by single extensions. In this paper, we introduce the CRX-ray detection framework to identify API key leakage in browser extensions. By open-sourcing CRX-ray, we aim to empower developers to identify and mitigate API key leakage, fostering the development of more secure browser extensions that protect both developers and users.

U2 - 10.1145/3779208.3785378

DO - 10.1145/3779208.3785378

M3 - Conference contribution

SP - 1200

EP - 1212

BT - ASIA CCS '26: Proceedings of the ACM Asia Conference on Computer and Communications Security

PB - Association for Computing Machinery

ER -

CRX-ray: large-scale detection of API key leakage in browser extensions

Abstract

Access to Document

Fingerprint

Cite this