The lookup is cheap. The interruption is not. Vulnerability identifiers live in text. They arrive in vendor bulletins, release notes, tickets, pull requests, newsletters and chat, and every single one is inert: to find out whether it matters you select it, copy it, open a tab, search, read, then come back and find your place again. Do that thirty times on one Patch Tuesday page and the afternoon is gone, most of it spent on identifiers that turned out not to matter. The expensive part was never the lookup, it was the context switch around it.
One bulletin. A hundred and twenty identifiers.
On a real security update guide the extension finds 120 identifiers and loads 55 of them. The page is ordered by release date; the sidebar re-orders it by what is being exploited. The rest wait, because fetching a hundred and twenty records to answer a question about four of them is how a daily allowance disappears on a single page.
What it does, briefly
Hover any identifier
Every identifier in the page text is underlined. Hovering shows severity, age, affected product and whether anyone is exploiting it.
A real sidebar
Every identifier on the tab in one list, sorted KEV-first, filtered to what is exploited, malicious or critical. It stays open while you read.
Fourteen schemes
CVE, GHSA, OSV, EUVD, GCVE, MAL, RUSTSEC, PYSEC, GO, SNYK, DSA, USN, RHSA and ALAS, because a distribution notice does not cite a CVE.
Both engines
Chrome, Edge, Brave, Arc, Opera, Vivaldi and Chromium from one build; Firefox, Firefox ESR, Zen, LibreWolf and Waterfox from a signed add-on.
The page never leaves
Detection is local. Page content, URLs, titles, history and anything you type are never transmitted, and there is no telemetry at all.
Lookups on request
A bulletin can carry more than a hundred identifiers. Fetching happens when you ask, results cache for a day, and running out degrades to a link.
Each of these has a fuller answer, including the architecture behind the privacy claims and the exact install steps for every browser, on the feature page.
An extension is a delivery mechanism. The data is the product.
Two extensions can underline the same text and disagree completely about what to do next, because the difference is not the hover card. It is what the identifier can be joined to. Every card can carry four KEV catalogues rather than one, with CISA binding remediation deadlines where they apply; exploit records counted across twenty sources with first and last observation dates; malware and typosquat records for packages that never receive a CVE; end-of-life data for a runtime nobody will patch again; and EPSS alongside CVSS, because how bad something would be and whether anyone is doing it are different questions. That comes from the same VDB the CLI, the pipeline, the console and the MCP server read: 150+ upstream sources across 4.8M advisory records and 173M affected-version rows.
It reads every page. Here is exactly what it sends.
Vulnerability identifiers, and only when you ask for them — when you hover one, when you open the sidebar, or if you deliberately turn on prefetch. Your API key travels with the lookup. That is the complete list. Never transmitted: page URLs, titles or content, your history, tabs, bookmarks or cookies, and anything you type, because the scanner skips inputs, text areas and editable regions entirely. There is no telemetry, no analytics and no crash reporting of any kind. The credential lives in the background worker and is never handed to the script running beside the page, so a compromised site cannot exfiltrate something it was never given.
The permissions list is short enough to check: storage, alarms, the side panel and two API hosts. Tabs, scripting, web navigation, cookies and all-URLs are deliberately not requested, and a build check fails if that changes. You can also disable it per site, or invert it so it runs only where you say.