System and method of detecting hidden behavior of a browser extension

A system to detect hidden behavior of a browser extension comprising:

• a hardware processor configured to:
• launch a browser in a protected environment;
• perform one or more actions in the browser;
• track events occurring during the performing of the one or more actions;
• identify extension events from the events that are initiated by a browser extension;
• analyze the extension events for indications of change that correspond to behavior not previously declared by the browser extension;
• determine that the browser extension is performing hidden behavior when indications of change are found.

A computer-readable medium storing instructions thereon to detect hidden behavior of a browser extension, the instructions comprising:

• launching a browser in a protected environment;
• performing one or more actions in the browser;
• tracking events occurring during the performing of the one or more actions;
• identifying extension events from the events that are initiated by a browser extension;
• analyzing the extension events for indications of change that correspond to behavior not previously declared by the browser extension;
• determining that the browser extension is performing hidden behavior when indications of change are found.