Is it legal to check manifest.json from an extension you don't own to assess its security risks before installing it

[ilyaigpetrov]

Hi, dear developers.

There are many extensions for viewing/unpacking source codes of extension packages published on the WebStore. E.g. this one: https://chrome.google.com/webstore/detail/chrome-extension-source-v/jifpbeccnghkjeaalbbjmodiffmgedin.

I personally use it to assess the risk of installing malware extension by viewing into permissions and  Content Security Policy in manifest.json.

My question: is this particular use case (checking manifest to assess risk) legal?

[wOxxOm]

Looking at manifest.json of an extension that you are about to install is not even a legally regulated matter so of course you can look at it. Just like you can look at the table of contents of a book you are about to read. I guess the question is about whether it's legal to download the contents of an extension without installing it? Yes, it's legal if you're older than 13 per the terms of service at https://ssl.gstatic.com/chrome/webstore/intl/en/gallery_tos.html

> 1.2 You may use the Web Store to browse, locate, and download Products (defined as software, content and digital materials created for use in connection with Google Chrome and distributed via the Web Store) for use in connection with Google Chrome [...]

> 1.4 In order to use the Web Store you must be 13 years of age or older. If you are between 13 and 18 years of age, you must have your parent or legal guardian’s permission to use the Web Store.

[ilyaigpetrov]

Thank you, wOxxOm.