Verify our manifest.json in 10 seconds
Use our Permission Checker or inspect `chrome://extensions` after installing: you will see `permissions: ["activeTab", "storage"]` and zero site access until clicked.
Least-privilege AI Chrome extension for cybersecurity & AppSec analysts.
Triage CVEs, deconstruct obfuscated scripts, and audit IAM policies in Chrome or Firefox with a zero-background-script activeTab architecture.
Best fit
Best for AppSec engineers, SOC analysts, cloud security architects, and penetration testers who refuse extensions with <all_urls> host permissions.
On-screen walkthrough
How this looks on a real webpage.
Instead of switching tabs and rebuilding context, highlight the exact passage that slowed you down and press your shortcut (default: Ctrl+Shift+X or Cmd+Shift+X on macOS, fully customizable in settings).
1. Highlighted on page (AWS IAM Policy Document — Privilege Escalation Review)
{ "Version": "2012-10-17", "Statement": [{ "Effect": "Allow", "Action": ["iam:PassRole", "lambda:CreateFunction", "lambda:InvokeFunction"], "Resource": "*" }] }
Ctrl+Shift+X“Identify the privilege escalation path in this IAM policy and how to lock it down.”
2. Vezz me on-screen answer overlay
1. **Critical Privilege Escalation (`iam:PassRole` + `lambda:CreateFunction`)**:
- Because `Resource` is `"*"`, a principal with this policy can create a new Lambda function, attach **any existing Administrator IAM execution role** via `iam:PassRole`, and invoke the function to execute arbitrary AWS API calls as Admin.
2. **Remediation**:
- Scope `iam:PassRole` `Resource` to a dedicated non-privileged role ARN (`arn:aws:iam::123456789012:role/lambda-app-*`).
- Add a `Condition` enforcing `"iam:PassedToService": "lambda.amazonaws.com"`.
3. Suggested follow-up questions in thread
- “Write the remediated IAM JSON policy splitting `PassRole` from `CreateFunction`.”
- “What other AWS services combine with `iam:PassRole` for privilege escalation?”
Step-by-step workflow
How to run this workflow in place.
Import the Security Threat Modeler & Regex Deconstructor presets
Load our AppSec presets into Vezz me for 1-click STRIDE audits and regex/SQL deconstruction.
Highlight CVEs, IAM policies, or PR diffs and press your shortcut
Analyze public advisories or code snippets on demand without running background DOM observers on your SIEM or cloud console.
Key details
Why this approach works better than switching tabs.
Comparison Matrix
Security Posture: Vezz me vs Mainstream AI Extensions
Comparing manifest permissions and attack surface.
| Security Control | Vezz me | Typical AI Sidebar Extension |
|---|---|---|
| Requested Permissions | activeTab, storage (only 2 permissions) | <all_urls>, tabs, scripting, webRequest, cookies |
| Persistent Content Scripts | 0 background content scripts | Injected into every HTTP/HTTPS frame automatically |
| Access to Unselected SIEM / Cloud Tabs | Impossible (enforced by browser activeTab sandbox) | Granted 24/7 across all open tabs |
Frequently asked questions
Common questions about persona guide — appsec & infosec.
Can I audit Vezz me with your Permission Checker tool?
Yes! Visit our AI Chrome Extension Permission Checker to compare Vezz me's manifest against any other extension.
Does Vezz me ever read my clipboard or cookies?
Never. Vezz me does not request clipboardRead, cookies, history, or webRequest permissions.
Can Vezz me explain shell one-liners and PowerShell flags in threat intel reports?
Yes. Highlight any command line or script snippet in a threat advisory and ask Vezz me to break down every flag and network/filesystem side effect.
Related workflows & guides
Explore connected pages.
Ready to try this workflow on your own reading?
Install Vezz me free, highlight text on any webpage, and press your customizable shortcut (default: Ctrl+Shift+X or Cmd+Shift+X on Mac) to get an answer right beside the source.
