CVE Hunter Pro: One-Click CVE Triage, Built as a Chrome Extension

Why I got tired of opening six tabs for every CVE, and what I built instead

Every CVE triage session starts the same way. A ticket lands with a CVE ID in it, and you open NVD in one tab to read the CVSS vector, FIRST.org in another to check the EPSS exploit-probability score, CISA's KEV catalog in a third to see if it's actively being exploited, and GitHub in a fourth to check whether a proof-of-concept already exists in the wild. By the time all four tabs have loaded, you've spent more time context-switching than actually reading the data.

CVE Hunter Pro collapses that workflow into one popup. Type a CVE ID, hit Enter, and every signal a triage engineer actually needs — CVSS, EPSS, KEV status, affected products, and ranked GitHub PoCs — comes back in a single request cycle.

It's a Manifest V3 Chrome extension, MIT-licensed, and the whole thing is plain HTML/CSS/JS with no build step. The source is on GitHub.

What it actually does

Feed it a CVE ID in any reasonable format — CVE-2024-12345, 2024-12345, or even CVE2024-12345 — and it normalizes the input before firing off requests. What comes back:

• CVSS score and severity, rendered as a gauge, with the newest available metric version selected automatically (v4.0 → v3.1 → v3.0 → v2.0, falling back down the chain as needed).
• Attack-vector breakdown — AV, AC, AT, PR, UI — decoded from the raw vector string into plain-English labels instead of making you memorize the CVSS spec.
• EPSS score and percentile, so severity isn't judged on CVSS alone. A 9.8 with a low EPSS percentile and a 6.5 with a high one tell very different stories about what to patch first.
• CISA KEV status, flagging known-exploited vulnerabilities along with their required-action deadline.
• Affected products, parsed out of the CPE match strings so you're not reading raw CPE URIs.
• Ranked GitHub PoC search — repositories referencing the CVE ID, sorted by stars, so you know within seconds whether working exploit code is already circulating.
• Quick-pivot links to Exploit-DB, GitHub, Nuclei templates, Metasploit, VulDB, and Snyk, for the next step in the workflow.
• Categorized references pulled straight from NVD — Patch, Vendor Advisory, Exploit, Mitigation, Third-Party Advisory — instead of one undifferentiated link dump.

Under the hood

The architecture is deliberately boring, which is the point:

cve-hunter-pro/
├── manifest.json      # MV3 manifest — permissions, host permissions, icons
├── background.js      # Minimal service worker (install/update lifecycle only)
├── popup.html         # Popup markup
├── popup.css          # Popup styling
├── popup.js           # All application logic (fetch, render, state)
└── icons/

cve-hunter-pro/
├── manifest.json      # MV3 manifest — permissions, host permissions, icons
├── background.js      # Minimal service worker (install/update lifecycle only)
├── popup.html         # Popup markup
├── popup.css          # Popup styling
├── popup.js           # All application logic (fetch, render, state)
└── icons/

No framework, no bundler, no build step. Reload the unpacked extension in chrome://extensions and you're looking at your change.

Request flow. fetchNVD() runs first and is treated as required — if it fails, the popup shows an explicit error state rather than a half-populated screen. fetchEPSS() and fetchGitHub() then run in parallel via Promise.all, and both are allowed to fail independently without blocking the CVSS and description render. A CVE with no EPSS score yet, or a GitHub search that hits a rate limit, still gives you a usable result instead of an all-or-nothing failure.

CVSS version fallback. NVD doesn't always return every metric version for a given CVE, so the extension walks the priority chain itself:

function getBestCVSS(metrics) {
  if (!metrics) return null;
  // Priority: v4.0 → v3.1 → v3.0 → v2.0
  return metrics.cvssMetricV40?.[0]
      || metrics.cvssMetricV31?.[0]
      || metrics.cvssMetricV30?.[0]
      || metrics.cvssMetricV2?.[0]
      || null;
}

function getBestCVSS(metrics) {
  if (!metrics) return null;
  // Priority: v4.0 → v3.1 → v3.0 → v2.0
  return metrics.cvssMetricV40?.[0]
      || metrics.cvssMetricV31?.[0]
      || metrics.cvssMetricV30?.[0]
      || metrics.cvssMetricV2?.[0]
      || null;
}

Older CVEs that only ever got a v2.0 score still render correctly, rather than showing a blank gauge.

Session persistence — the fix that mattered most. Chrome tears down an extension's popup the instant it loses focus, and every reference, PoC, or quick-pivot link opens in a new tab with target="_blank" — which means the popup closes the moment you click any of them. Earlier versions lost the current lookup on every outbound click. The fix caches each completed search, along with the active tab (Overview / Exploits / References), to chrome.storage.session — in-memory storage that's cleared on browser restart, distinct from chrome.storage.local, which is reserved for settings and search history and persists indefinitely. init() now checks that session cache before falling back to an empty state, so clicking through to a patch link and coming back doesn't cost you your place.

Permissions, minimized on purpose

The manifest requests exactly two permissions — storage and clipboardWrite — plus host permissions scoped to the three APIs it actually talks to: services.nvd.nist.gov, api.first.org, and api.github.com. No broad <all_urls> access, no content scripts injected into every page you visit. An optional NVD API key (raises the rate limit from 5 to 50 requests per 30 seconds) and an optional GitHub PAT (avoids search rate limiting) are stored locally via chrome.storage.local and sent only in that API's own request headers — never anywhere else.

What changed in 1.1.0

The most recent release was mostly a stability and polish pass:

• Fixed the popup-teardown data loss described above — the core reason this update happened.
• Fixed Settings closing back to whatever screen was actually open, instead of always resetting to empty.
• Fixed a --blue-hi CSS custom property that was referenced in five hover states but never defined.
• Fixed manifest.json icon paths that pointed at a folder missing from the packaged build.
• Replaced emoji glyphs with a consistent inline SVG icon set for cross-platform rendering.
• Rebalanced the color palette toward a more restrained, professional dark theme and dialed back the glow/pulse/shake effects.
• Added minimum_chrome_version: "102", since chrome.storage.session requires it.

Small fixes individually, but the kind that decide whether a tool feels finished or feels like a demo.

Try it

1. Clone the repo or download and unzip the release.
2. Open chrome://extensions, enable Developer mode.
3. Load unpacked, select the folder.
4. Pin it from the toolbar overflow menu.
5. Drop in an NVD API key and/or GitHub PAT under Settings if you're going to be running a lot of lookups.

That's the whole install. No account, no server component, no telemetry.

CVE Hunter Pro is intentionally narrow: it's a triage accelerator, not a scanner and not an exploit framework. It doesn't host, generate, or execute anything — it surfaces publicly available vulnerability intelligence and gets out of the way. PoC links are provided for authorized security research and testing only, and that stays the operating assumption throughout.

Source, issues, and contributions: github.com/youwannahackme/CVE-Hunter