SECURAPP · PERMISSIONS · EXTENSIONS
How to check a suspicious app or extension: the permissions guide
A productivity utility may access sensitive data if its permissions allow it. Unapproved installations, or shadow IT, expose organisations to abusive extensions and spyware, including infostealers targeting credentials and sessions.
Before authorising a new tool, compare its purpose and requested access. A suspicious app checker helps review signals without replacing code analysis or approval by your IT team.
1. Decode an extension manifest
Identify broad access
Patterns such as *://*/* and <all_urls> can cover many sites; http://*/* concerns HTTP, not HTTPS by itself. Actual scope depends on the browser, granted permissions and context. A content blocker may legitimately need broad access: examine necessity rather than automatically concluding it is malware.
Read permissions, host_permissions and content_scripts
The manifest.json describes declared capabilities and targeted pages. Compare cookie, network-request and page-content access with the stated purpose. webRequest or storage does not prove malicious intent: use depends on other permissions and code. A manifest does not reveal all extension behaviour.
Import without executing
A web page cannot automatically inventory all your extensions. SecurApp accepts a manually imported extension manifest.json to flag sensitive permissions or broad access. Ask IT for the file if needed. Do not install an unknown extension merely to obtain its manifest.
2. Assess Android apps and APKs
Check the source and permissions
An APK is a distribution format, not proof of malware. An unknown source increases uncertainty about the publisher and updates. Installing outside a store does not automatically disable Android protections: Play Protect can also inspect these apps on supported devices. Do not disable protection to bypass a warning.
Compare permissions with the stated purpose
SMS, contacts, microphone or precise location access should have a clear purpose. Consider when and for how long access is needed. Unrelated permissions warrant refusal or verification with the publisher and IT. SecurApp’s manifest module is not a complete APK audit.
Treat accessibility as sensitive access
Accessibility services have essential legitimate uses. Depending on authorised capabilities, they can also read displayed elements and act on the interface. Abusive software may misuse these rights for spying or manipulating actions. Do not grant access at a stranger’s request; exact capabilities vary by app and Android version.
3. Essential checks before installing
Verify the publisher and history
Cross-check the publisher, official website, download source and recent updates. Ratings and installation counts are insufficient. Review detailed reports of changed behaviour without treating every slowdown as proof of infection.
Apply least privilege
Grant only necessary permissions. Where supported, restrict access to required sites or an explicit action. Pause installation and ask IT if a permission seems excessive. On managed devices, follow installation policy and the approved tools list.
Review extensions and updates
Remove unused tools and review new permission requests. A publisher change or update can alter the risk of a previously trusted extension. Schedule reviews with IT. Report suspected data theft: uninstalling does not revoke sessions already stolen.
Conclusion: keep control of third-party access
An online app review helps pause rushed approvals. Combine permission reviews with publisher checks, managed updates and endpoint protection. No manifest or score alone guarantees the absence of infostealers.
Deploy SecurCheck Business to support your teams’ endpoint security