The Cyber Resilience Act now covers paid and freemium extensions. ExtensionCRA generates your SBOM, flags risky permissions, and writes the documents the EU expects, so you can get back to shipping.
We'll email you the checklist and occasional launch news. Unsubscribe in one click.
$ npx extcra scan Manifest: manifest.json (MV3) Dependencies: 214 from package-lock.json Tab Tidy 1.2.0 3 high 3 medium 1 low High Requests access to all websites High High-risk permission: cookies High Vulnerable dependency: lodash@4.17.15 Medium Outdated bundled library: jquery 3.4.0 Medium Runs code built from strings (2 places) Medium No vulnerability disclosure policy Report: cra/scan-report.md SBOM: cra/sbom.cdx.json (CycloneDX 1.5)
You're likely in scope if EU users can install your extension and it earns money in any way: a price, a paid tier, ads or affiliate links. The European Commission's July 2026 guidance names browser extensions explicitly. Being based outside the EU doesn't exempt you.
Actively exploited vulnerabilities must be reported within 24 hours.
Full requirements: SBOM, risk assessment, support period, declaration of conformity.
of worldwide annual turnover, whichever is higher, for breaching the essential requirements.
One command for the technical work. It runs locally, and only package names and versions are sent out for the vulnerability lookup.
A machine-readable bill of materials from your npm, Yarn or pnpm lockfile, plus libraries you copied in by hand.
Annex I, Part II(1)Known advisories in your dependencies and in bundled copies of libraries like jQuery and Bootstrap, with the version to upgrade to.
Annex I, Part I(2)(a)Flags access to every site, risky permissions, exposed files and unsafe policies, and gives you a table to justify the rest.
Annex I, Part I(2)(g), (j)Finds scripts loaded from servers, eval and string injection: the patterns stores reject and attackers use.
Annex I, Part I(2)(f)security.txt, a disclosure policy, support period, risk assessment, user security information and a Declaration of Conformity draft.
Annexes II, V, VIIWho to tell and what to send at 24 hours, 72 hours and after the fix, plus a lockdown guide for your store account.
Article 14Early-bird buyers get every future version. Tested on 14 open-source extensions before launch.
No. It's a tool that produces the technical evidence and the document drafts. You stay responsible for your product.
Yes, if EU users can install your extension. Where you're based doesn't change that.
A free extension that makes no money at all is generally out of scope. Ads, affiliate links or a paid tier bring it in.
No. The scan runs locally. Only package names and versions go to the npm registry's public advisory service.
Pre-orders fund the launch. You get beta access within about six weeks, or a full refund.
Six sections, about 20 minutes, written for extension developers.