Inside the Mozilla Add-ons Review Process for Firefox

Ensuring the safety of browser extensions is a critical priority for Mozilla. This article provides a comprehensive breakdown of how the Mozilla Add-ons (AMO) platform vets extensions submitted for the Firefox web browser. By combining rapid automated scanning with rigorous human code inspections and post-publication monitoring, Mozilla balances fast publishing times for developers with robust security protections for end-users.

The Automated Review Phase

When a developer submits an extension to AMO, it immediately undergoes an automated validation process. Mozilla uses a specialized tool called the Add-ons Linter to perform static analysis on the extension's package.

During this phase, the automated system performs several checks:

  • Manifest Validation: It checks the manifest.json file for structural errors, deprecated APIs, and invalid permission requests.
  • Code Scanning: It scans the JavaScript, HTML, and CSS files for known security vulnerabilities, unsafe coding practices, and recognizable malware patterns.
  • Library Verification: It compares third-party libraries (like jQuery or React) against a database of known, unaltered versions to ensure the developer has not injected malicious code into standard libraries.

If the extension passes these automated checks without raising critical errors, it is digitally signed by Mozilla and published to the store, often within minutes.

Risk Assessment and Prioritization

Because most standard extensions go live immediately after passing the automated checks, the system simultaneously calculates a risk score for every submission. This risk score determines how quickly a human reviewer needs to look at the extension.

The algorithm assigns risk based on several factors:

  • Requested Permissions: Extensions asking for powerful capabilities—such as accessing data on all websites, reading browsing history, or managing downloads—receive a high risk score.
  • Code Characteristics: Scripts that appear overly complex, dynamically load remote data, or use unconventional structures are flagged for closer scrutiny.
  • Developer Reputation: Submissions from brand-new developer accounts or those with a history of rejected extensions are prioritized over long-standing, trusted developers.

The Human Review Process

Human reviewers focus their efforts on the extensions placed at the top of the risk queue, while also conducting random spot-checks on lower-risk submissions. During a manual review, an AMO security specialist downloads the extension and reads the source code line by line to understand its exact functionality.

Mozilla strictly prohibits obfuscated or unreadable code. However, many modern developers use legitimate build tools (such as Webpack or Rollup) or minifiers that make code difficult for humans to read. If an extension uses these tools, the developer is required to submit the original, unminified source code along with instructions on how to build it.

The human reviewer will then:

  1. Follow the developer's instructions to compile the source code in a secure environment.
  2. Compare the newly generated package against the package the developer uploaded to ensure they are an exact match.
  3. Inspect the original source code for hidden tracking, data harvesting, or backdoors.
  4. Test the extension in Firefox to ensure it functions as advertised and abides by Mozilla’s Add-on Policies, such as requiring explicit user consent before collecting personal data.

Firefox features a curated collection of "Recommended" extensions that meet the highest standards of security, utility, and user experience. The vetting process for these extensions is fundamentally different from standard submissions.

Extensions in the Recommended program do not bypass human review. Every single submission and subsequent update to a Recommended extension must undergo a mandatory, comprehensive manual code review by a human before it is digitally signed and distributed to users.

Post-Publication Enforcement and the Blocklist

Because standard extensions can be installed by users before a human reviewer inspects the code, Mozilla relies on a strict post-publication enforcement mechanism. Users and security researchers can also manually report suspicious add-ons, which immediately escalates them to the human review queue.

If a human reviewer discovers a policy violation or security flaw in a live extension, they take immediate action based on the severity of the issue:

  • Minor Violations: If the issue is an accidental coding error or a minor policy oversight, the reviewer contacts the developer and gives them a strict deadline to upload a fixed version.
  • Malicious Intent: If the extension is found to be malware, spyware, or intentionally deceptive, the reviewer immediately disables the listing on AMO, suspends the developer's account, and revokes the extension's digital signature.

For severe threats, Mozilla adds the extension to the Firefox Blocklist. The browser checks this list daily. When an extension is blocklisted, Firefox automatically disables and removes the malicious add-on from all users' computers globally, neutralizing the threat without requiring any action from the user.