A computer-implemented method, a system and a computer program product for determining whether a browser extension leaks information over a network, is provided. A control flow graph (CFG) is generated from a source code included in the browser extension. The CFG is particular to the programming language included in the source code. A sensitive path in the CFG is determined. The sensitive path begins at a sensitive source node and ends at a sensitive end node. A set of tainted variables in the CFG are identified, where each tainted variable stores sensitive or personal information. A subset of tainted variables is generated where each tainted variable in the subset is included in the sensitive path. When a tainted variable in the subset is included in the sensitive end node, the browser extension is determined to leak information over the network.