# US 2025/0094580 A1 · Dynamic analysis for malicious browser extensions > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2025/0094580 A1 - Document ID: US20250094580A1 - Status: Published application - Kind: A1 - Application number: 18/467,444 - Filed: 2023-09-14 - Published: 2025-03-20 - Earliest claimed: 2023-09-14 - Assignees: Avast Software s.r.o. - Applicants: Avast Software s.r.o. - Inventors: Iskander Sanchez-Rola; Venkadesan Marimuthu - Web page: https://patentgrep.com/patent/US20250094580A1 ## CPC - G06F 21/563: {by source code analysis} - G06F 21/53: by executing in a restricted environment, e.g. sandbox or secure virtual machine - G06F 21/566: {Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities} - G06F 2221/033: Test or assess software - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract The behavior of browser extensions when installed and operating in a browser environment is monitored, such as by observing changes to a web page with and without the browser extensions installed. Document Object Model (DOM) changes to the web page, such as scripts that only run when an extension is installed, or other web content that changes as a result of differences in a web page with and without the browser extension installed are observed. These differences may be attributed to the browser extension, and the changed or added elements may be inspected for malicious content or behavior. If malicious behavior is found in the different content, the content and/or the browser extension may be flagged as malicious behavior and a signature used to identify the malicious browser extension in future applications. ## Claims ### Claim 1 A method of evaluating a browser extension for malicious content, comprising: installing the browser extension in a web browser having one or more instrumentation features; using the web browser to browse one or more websites; analyzing scripts in the initial website code; analyzing scripts in the website code as modified by the browser extension; comparing the scripts in the initial website code as modified by the browser extensions to the scripts in the initial website code; and identifying scripts injected by the extension based on the comparing the scripts in the initial website code as modified by the browser extensions to the scripts in the initial website code. ### Claim 2 (depends on 1) The method of evaluating a browser extension for malicious content of claim 1, further comprising identifying modification of the Document Object Model of the one or more websites due to the script injected by the extension. ### Claim 3 (depends on 2) The method of evaluating a browser extension for malicious content of claim 2, further comprising evaluating the identified modification of the Document Object Model of the one or more websites for malicious behavior. ### Claim 4 (depends on 3) The method of evaluating a browser extension for malicious content of claim 3, further comprising extracting the identified modification of the Document Object Model determined to have malicious behavior as a malicious behavior signature. ### Claim 5 (depends on 1) The method of evaluating a browser extension for malicious content of claim 1, further comprising evaluating the one or more identified scripts injected by the extension for malicious behavior. ### Claim 6 (depends on 5) The method of evaluating a browser extension for malicious content of claim 5, further comprising extracting a signature of one or more identified scripts evaluated as having malicious behavior as a malicious behavior signature. ### Claim 7 (depends on 1) The method of evaluating a browser extension for malicious content of claim 1, wherein the browser is installed in a sandbox environment on a server. ### Claim 8 (depends on 1) The method of evaluating a browser extension for malicious content of claim 1, wherein the browser is a headless browser installed on a client device. ### Claim 9 (depends on 1) The method of evaluating a browser extension for malicious content of claim 1, wherein the method is initiated or triggered by observing installation of an unrecognized browser extension. ### Claim 10 (depends on 1) The method of evaluating a browser extension for malicious content of claim 1, wherein the one or more websites browsed are determined at least in part from websites identified by the browser extensions. ### Claim 11 (depends on 10) The method of evaluating a browser extension for malicious content of claim 10, wherein the one or more websites browsed are determined at least in part by a browser extension manifest. ### Claim 12 A system, comprising: a computing device comprising a processor and a nonvolatile storage, the nonvolatile storage comprising coded instructions that when executed on the computing device cause the computing device to: cause the web browser to browse one or more websites; analyze scripts in the initial website code; analyze scripts in the website code as modified by the browser extension; compare the scripts in the initial website code as modified by the browser extensions to the scripts in the initial website code; and identify scripts injected by the extension based on the comparing the scripts in the initial website code as modified by the browser extensions to the scripts in the initial website code. ### Claim 13 (depends on 12) The system of claim 12, the instructions when executed further operable to cause the computing device to identify modification of the Document Object Model of the one or more websites due to the script injected by the extension. ### Claim 14 (depends on 13) The system of claim 13, the instructions when executed further operable to cause the computing device to evaluate the identified modification of the Document Object Model of the one or more websites for malicious behavior. ### Claim 15 (depends on 14) The system of claim 14, the instructions when executed further operable to cause the computing device to extract the identified modification of the Document Object Model determined to have malicious behavior as a malicious behavior signature. ### Claim 16 (depends on 12) The system of claim 12, instructions when executed further operable to cause the computing device to evaluate the one or more identified scripts injected by the extension for malicious behavior. ### Claim 17 (depends on 16) The system of claim 16, instructions when executed further operable to cause the computing device to extract a signature of one or more identified scripts evaluated as having malicious behavior as a malicious behavior signature. ### Claim 18 (depends on 12) The system of claim 12, wherein the system comprises one or more of a server having the browser installed in a sandbox environment and a client device executing the browser as a headless browser. ### Claim 19 (depends on 12) The system of claim 12, wherein the process is initiated or triggered by observing installation of an unrecognized browser extension. ### Claim 20 (depends on 12) The server of claim 12, wherein the one or more websites browsed are determined at least in part from one or more of websites identified by the browser extensions and from a browser extension manifest.