The present disclosure is directed towards systems and methods for detecting hidden behavior in browser extensions. In one example, a method is provided comprising launching a browser in a protected environment, performing one or more actions in the browser, tracking events occurring during the performing of the one or more actions, identifying extension events from the events that are initiated by a browser extension, analyzing the extension events for indications of change that correspond to behavior not previously declared by the browser extension, and determining that the browser extensionis performing hidden behavior when indications of change are found.