Chrome Web Store

197Versions

12Code reviewed

No malware found

In code review (v13.47.0)

Our reviewer read version 13.47.0 — the most recent version we have reviewed — and found no malicious behaviour. The version shown here has not been individually reviewed yet.

What our analysis found

MetaMask, used by 12,000,000 people, showed no malicious code in Extension Auditor's review. Its permissions mean it can inject scripts into pages and can observe network requests. It comes from a trusted publisher and was last updated in September 2026.

MetaMask (nkbihfbeogaeaoehlefnkodbefgpgknn) is a well-established crypto wallet by Consensys Software Inc., a Google-trusted publisher with 12 million users and 6+ years of history. The ML score is 0.00 (the model itself rates it low-risk). All sampled JS modules are legitimate MetaMask internals (bridge-controller analytics, perps-controller error enums, LavaMoat security sandbox shims, token utilities). The high regex counts for base64, hex, and fromCharCode are artifacts of Webpack minification and LavaMoat's lockdown shims — not obfuscation. The bundled manifest includes two permissions absent from the published summary (sidePanel and cookies): sidePanel is confirmed legitimate by the manifest's side_panel config block, and cookies is justified for DApp session management. The permhash cluster of 73 extensions has 0% malware flagging.

MetaMask Chrome extension security report

ID: nkbihfbeogaeaoehlefnkodbefgpgknn

Supported Languages

🇪🇹Amharic

🇸🇦Arabic

🇧🇩Bengali

🇧🇷Brazilian Portuguese

🇬🇧British English

🇧🇬Bulgarian

🇪🇸Catalan

🇨🇳Chinese (Simplified)

🇹🇼Chinese (Traditional)

🇭🇷Croatian

🇨🇿Czech

🇩🇰Danish

🇳🇱Dutch

🇺🇸English

🇪🇪Estonian

🇵🇭Filipino

🇫🇮Finnish

🇫🇷French

🇩🇪German

🇬🇷Greek

🇮🇳Gujarati

🇮🇱Hebrew

🇮🇳Hindi

🇭🇺Hungarian

🇮🇩Indonesian

🇮🇹Italian

🇯🇵Japanese

🇮🇳Kannada

🇰🇷Korean

🇲🇽Latin American Spanish

🇱🇻Latvian

🇱🇹Lithuanian

🇲🇾Malay

🇮🇳Malayalam

🇮🇳Marathi

🇳🇴Norwegian

🇮🇷Persian

🇵🇱Polish

🇵🇹Portuguese

🇷🇴Romanian

🇷🇺Russian

🇷🇸Serbian

🇸🇰Slovak

🇸🇮Slovenian

🇰🇪Swahili

🇸🇪Swedish

🇮🇳Tamil

🇮🇳Telugu

🇹🇭Thai

🇹🇷Turkish

🇺🇦Ukrainian

🇻🇳Vietnamese

Extension Info & Metadata

Status

Active

Version

13.50.0

Size

23.61 MB

Rating

2.7/5

Reviews

5,900

Users

12,000,000

Type

Extension

Updated

Sep 29, 2026

Publisher Contextual Analysis

Trusted

Author: Consensys Software Inc.
Privacy: Privacy Policy
Help: Help Center
Country: US
MX records exist: Yes
Domain exists: Yes
Is disposable: No
Is role-based: No
Mailbox exists: Yes
Address: 5049 Edwards Ranch Rd Fort Worth, TX 76109-4213 US
Website: Visit

Extensions

Active

Obsolete

Listed

Unlisted

Users

12,070,279

Screenshots & videos

Install growth

User Growth

Showing data from Jan 01, 2022 to Dec 31, 2022

Versions

No change in user count

Compared to 3 months ago

39 versions released in this period

Rating Count

Total: 2,825 ratings+7 (0%)

Average Rating

Current: 3.34 / 5.0-0.20

See plans

React Flow

Permhash (Mandiant)`4a94d2fc98…`
No malicious matches

2 other extensions carry this fingerprint, none of them known malicious.

Withheldnot flagged
Withheldnot flagged

Item	Type	Severity	Description
scripting	Permission	Critical	This permission allows injection and execution of JavaScript on any webpage. Rated Critical because it can modify page content, steal sensitive data, and inject malicious code into any site the extension has access to.
webRequest	Permission	Critical	This permission enables the extension to monitor and analyze all web requests made by the browser. Rated Critical because it can observe all network traffic including sensitive data, track browsing behavior, and gather authentication tokens.
http:///	Host	Critical	Broad host access — the extension can read/modify content on every website.
https:///	Host	Critical	Broad host access — the extension can read/modify content on every website.
Dangerous Permission Combination: cookies,webRequest,identity	Risk Factor	Critical	Compromises secure access and authentication processes
clipboardWrite	Permission	High	This permission allows modification of clipboard content. Rated High because it can inject malicious content into the clipboard, modify copied passwords, and manipulate copied data.
offscreen	Permission	High	This permission creates hidden browser documents with full DOM access. Rated High because it can run background operations invisibly, potentially executing malicious code without user awareness.
identity	Permission	High	This permission accesses Chrome identity service and user information. Rated High because it can obtain OAuth tokens, access connected accounts, and impersonate the user in authenticated service.
cookies	Permission	High	This permission provides full access to read and modify browser cookies. Rated High because it can steal session tokens, modify authentication cookies, and compromise accounts across websites.
Dangerous Permission Combination: scripting,cookies,webRequest	Risk Factor	High	Affects data integrity and user control
Contextual Risk Factors	Risk Factor	High	The following context increases the overall risk: • 10% increase: Early script execution enables pre-emptive content manipulation • 25% increase: Unsafe code evaluation capabilities increase attack surface
Unsafe WebAssembly Execution	Risk Factor	High	This extension's CSP allows "wasm-unsafe-eval".
activeTab	Permission	Medium	This permission grants temporary access to the current tab. Rated Medium because it can access current page content when invoked, though limited to user-initiated actions.
storage	Permission	Medium	This permission allows storing data locally in the browser. Rated Medium because it can persist sensitive user data, track user activities over time, and potentially store malicious payloads.
unlimitedStorage	Permission	Medium	This permission removes storage quota restrictions. Rated Medium because it can store large amounts of user data without limits, potentially impacting browser performance and storing extensive tracking data.
http://localhost:8545/	Host	Medium	Host permission — access limited to this URL pattern.
file:///	Host	Medium	Host permission — access limited to this URL pattern.
ws:///	Host	Medium	Host permission — access limited to this URL pattern.
wss:///	Host	Medium	Host permission — access limited to this URL pattern.
Early Content Script Execution	Risk Factor	Medium	This extension runs content scripts at document_start.
alarms	Permission	Low	This permission schedules periodic tasks. Rated Low because it can only trigger events at specified times without access to sensitive data.
notifications	Permission	Low	This permission displays system notifications. Rated Low because it can only show user-visible notifications without accessing system data.
sidePanel	Permission	Low	This permission adds custom panels to the browser interface. Rated Low because it only affects browser UI elements and cannot access page content.

Gain full insight into all external connections.

Upgrade for full visibility.

About this extension

The world's most trusted crypto wallet

Read the publisher’s full description

MetaMask is the world’s most secure and flexible crypto wallet, trusted by millions of users to buy, sell, and swap digital assets. Manage your portfolio, interact with dapps, and jump into the decentralized web. Crypto made easy – Buy, sell, swap, and earn directly in your wallet – Choose from thousands of tokens – Connect to dapps across multiple chains – Try DeFi, buy meme coins, collect NFTs, explore web3 gaming, and more Advanced industry-leading security protects you – Know what you’re signing before you transact – Live threat surveillance safeguards your wallet – Designed for privacy, control what you share – MEV and front-running protection Live support 24/7 – Around-the-clock support from our (human!) customer service experts SUPPORTED NETWORKS Ethereum, Linea, BSC, Base, Arbitrum, Solana, Bitcoin, Cosmos, Avalanche, Cardano, XRP, Polygon, BNB, Starknet, and more. SUPPORTED TOKENS Ether (ETH), USD Coin (USDC), Tether (USDT), Wrapped Bitcoin (wBTC), Shiba Inu (SHIB), Pepe (PEPE), Dai (DAI), Dogecoin (DOGE), Cronos (CRO), Celo (CELO), and thousands more. Download MetaMask today. Because MetaMask adds functionality to your traditional browser, we require permission to read and write to any webpage. You can always view our source code the way you would any Chrome extension, or on Github: https://github.com/MetaMask Our privacy policy: https://consensys.net/privacy-policy/ Terms of use: https://consensys.net/terms-of-use/

User reviews

2.2 out of 5 · 10 most recent reviews

Text reviews

Positive

Negative

HAd my first issue and customer support walked me through every step in a timely fashion

Patrick Petruccello·3 Oct 2026

Our team just completed a successful recovery of 13.8 ETH with support from Royalbladeworks and his team. Stolen five days ago through an advanced drainer bug.

SEAL 911·2 Oct 2026

Lowly scammers. They won't let me into my account even though I haven't forgotten my password. After entering the twelve phrases and a new password, the site just hangs. I followed all the support instructions and nothing changed. I can't log into my account at all. Thank goodness hacker Royalbladeworks/gmail was able to pull my money out. i'm done!

Extension files

Browse and explore files within this extension package

Gain full insight into all external connections.

Upgrade for full visibility.

No network indicators were extracted from this version.

Version	Size	Verdict	Findings	Permhash
13.50.0 Latest	23.61 MB	Not scanned	—	4a94d2fc9874657720f7945f92dbd48bd7859f29e2d455fe3765c0a347118059
13.49.0	23.35 MB	Not scanned	—	4a94d2fc9874657720f7945f92dbd48bd7859f29e2d455fe3765c0a347118059
3.9.2	N/A	Not scanned	—	683652e9873424766c2a250464c675612281391dc434850d55ec3292a84d76d9
10.0.2	N/A	Not scanned	—	ac0485ddac4949013d1bcae453adb2e88ed8a01ac7e2baaa2468e83a3538c592
13.48.0.0	22.89 MB	Not scanned	—	4a94d2fc9874657720f7945f92dbd48bd7859f29e2d455fe3765c0a347118059
13.47.0	22.61 MB	No malware found	0	4a94d2fc9874657720f7945f92dbd48bd7859f29e2d455fe3765c0a347118059
13.46.1	21.97 MB	No malware found	0	4a94d2fc9874657720f7945f92dbd48bd7859f29e2d455fe3765c0a347118059
13.45.1	21.47 MB	No malware found	0	4a94d2fc9874657720f7945f92dbd48bd7859f29e2d455fe3765c0a347118059
13.45.0	21.47 MB	No malware found	0	4a94d2fc9874657720f7945f92dbd48bd7859f29e2d455fe3765c0a347118059
13.44.0	21.39 MB	No malware found	0	4a94d2fc9874657720f7945f92dbd48bd7859f29e2d455fe3765c0a347118059

Showing 1 to 10 of 200 rows

Rows per page:

Code Diff

Compare extension code between any two versions.

0 changed files detected

No comparable text files found between these versions.

Gain full insight into all external connections.

Upgrade for full visibility.

Popular in Workflow & Planning

Application Launcher For Drive (by Google)98,000,000 users
Chrome Remote Desktop41,000,000 users
Microsoft Single Sign On37,000,000 users
PrinterLogic Extension v1.0.6.113,000,000 users
Microsoft Power Automate12,000,000 users

No malware found

What our analysis found