Firefox Extensions

Overview

Firefox stores extension (add-on) metadata in extensions.json, a JSON file within each profile directory. This file contains detailed information about every installed extension, theme, language pack, and dictionary, including version, permissions, installation source, active/disabled status, signature verification state, and blocklist status.

Extensions are forensically significant because they reveal user behaviour patterns, privacy tool usage, potential malware vectors, and browser capability modifications. A privacy-focused extension set (VPN, ad blocker, tracker blocker) suggests a security-conscious user, while unsigned or sideloaded extensions may indicate compromise.

File Locations

File Format

extensions.json Structure

{
  "schemaVersion": 35,
  "addons": [
    {
      "id": "uBlock0@raymondhill.net",
      "name": "uBlock Origin",
      "version": "1.54.0",
      "type": "extension",
      "description": "An efficient blocker...",
      "creator": "Raymond Hill",
      "homepageURL": "https://github.com/gorhill/uBlock",
      "active": true,
      "userDisabled": false,
      "appDisabled": false,
      "softDisabled": false,
      "blocklistState": 0,
      "installDate": 1710504000000,
      "updateDate": 1704873600000,
      "sourceURI": "https://addons.mozilla.org/firefox/downloads/file/...",
      "location": "app-profile",
      "visible": true,
      "signedState": 2,
      "incognito": "spanning",
      "permissions": {
        "permissions": ["dns", "menus", "privacy", "storage", "tabs",
                       "webNavigation", "webRequest", "webRequestBlocking"],
        "origins": ["http://*/*", "https://*/*"]
      }
    }
  ]
}

Key Fields for Analysis

Extension Types

Installation Locations

Signed State Values

Blocklist State Values

Timestamps

Extension timestamps use Unix milliseconds (milliseconds since 1970-01-01 UTC).

installDate = 1710504000000
Unix seconds = 1710504000000 / 1000 = 1710504000
Result = 2024-03-15T12:00:00Z

Analysis Notes

Risky Permission Detection

The macfor collector flags extensions with permissions that grant broad access or sensitive capabilities. The following permissions are flagged:

Broad host permissions are also flagged:

Source URI Analysis

The sourceURI field reveals where the extension was installed from:

• AMO (addons.mozilla.org): Standard installation from Mozilla's curated store.
• Direct URL download: Sideloaded from a third-party source.
• Empty or null: Built-in or enterprise-deployed extension.
• file:// URI: Locally installed from disk (developer or testing).

Identifying Suspicious Extensions

Red flags to investigate:

1. Unsigned extensions (signedState = 0): Cannot normally be installed in release Firefox.
2. Blocked extensions (blocklistState > 0): Mozilla identified the extension as harmful.
3. Extensions with nativeMessaging: Can execute arbitrary local programs.
4. app-temporary location: Developer sideloading, potential malware testing.
5. Extensions requesting <all_urls> + webRequestBlocking: Can intercept all traffic.
6. Unknown source URIs: Not from AMO.
7. Very recent install dates combined with broad permissions.

Incognito/Private Browsing Mode

The incognito field indicates how the extension behaves in private browsing:

An extension allowed in private browsing can observe activity the user intended to be ephemeral.

Useful Analysis Steps

1. List all active extensions with permissions: Focus on active: true extensions and their requested permissions.
2. Check for privacy/security tools: uBlock Origin, Privacy Badger, HTTPS Everywhere, VPN extensions indicate security awareness.
3. Check for development tools: Indicates a technical user (e.g., React DevTools, Redux DevTools).
4. Cross-reference blocked extensions: Any extension with blocklistState > 0 was identified as harmful by Mozilla.
5. Timeline of installations: Sort by installDate to see when the user's extension set evolved.

Version Differences

Since Firefox 57, all extensions must use the WebExtensions API. The extensions.json format has been stable across supported versions.

Tool Support

References

• Mozilla Source: AddonManager
• Mozilla AMO: Extension Policies
• Mozilla: WebExtensions Permissions
• SANS FOR518: Mac and iOS Forensic Analysis